36 lines
1.3 KiB
Markdown
36 lines
1.3 KiB
Markdown
# OAuth and App Link contract
|
|
|
|
## Registered values
|
|
|
|
```text
|
|
Authorization endpoint: https://gitea.ubisampaju.synology.me/login/oauth/authorize
|
|
Token endpoint: https://gitea.ubisampaju.synology.me/login/oauth/access_token
|
|
Client ID: 225589df-b992-4676-aae0-b2534ba7452d
|
|
Redirect URI: https://gitea.ubisampaju.synology.me/ubisampaju/oauth/callback
|
|
Grant: Authorization Code with PKCE
|
|
PKCE method: S256
|
|
Client secret: not used
|
|
```
|
|
|
|
## Required login flow
|
|
|
|
1. Create a random state and PKCE verifier.
|
|
2. Derive the S256 challenge.
|
|
3. Store only the minimum short-lived transaction state.
|
|
4. Open the authorization URL in the system browser.
|
|
5. Receive the verified HTTPS App Link.
|
|
6. Validate scheme, host, path, state, error, and authorization code.
|
|
7. Exchange the code using the original verifier.
|
|
8. Store tokens with Keystore-backed protection.
|
|
9. Clear transaction state on success, cancellation, or error.
|
|
|
|
## External prerequisite
|
|
|
|
The host must serve a valid Android Digital Asset Links file at:
|
|
|
|
```text
|
|
https://gitea.ubisampaju.synology.me/.well-known/assetlinks.json
|
|
```
|
|
|
|
It must identify the final Android application ID and signing-certificate SHA-256 fingerprint. OAuth end-to-end testing is blocked until those values and hosting are available.
|