33 lines
1.1 KiB
Markdown
33 lines
1.1 KiB
Markdown
# TASK-002: Prove OAuth PKCE and App Link end to end
|
|
|
|
Status: blocked by TASK-001 and external App Link configuration
|
|
Owner: Codex
|
|
Reviewer: Claude
|
|
|
|
## Outcome
|
|
|
|
A user can authorize UBGitea through the system browser, return through the verified App Link, exchange the code using PKCE, and view their Gitea identity.
|
|
|
|
## Acceptance criteria
|
|
|
|
- [ ] Uses a system browser, not WebView.
|
|
- [ ] Uses fresh random state and PKCE S256 per attempt.
|
|
- [ ] Rejects mismatched state and malformed callbacks.
|
|
- [ ] Does not require or contain a client secret.
|
|
- [ ] Does not log codes or tokens.
|
|
- [ ] Persists tokens with Keystore-backed protection.
|
|
- [ ] Handles success, cancellation, denied authorization, network failure, and expired transaction state.
|
|
- [ ] Calls the authenticated user endpoint and displays the user identity.
|
|
- [ ] Tests cover URL construction, PKCE, callback validation, and error mapping.
|
|
|
|
## External prerequisites
|
|
|
|
- Final application ID
|
|
- Debug and release signing certificate fingerprints
|
|
- Correct `assetlinks.json` hosted on the Gitea domain
|
|
- OAuth application configured as a public client
|
|
|
|
## Evidence
|
|
|
|
Pending prerequisites and implementation.
|