Archived
Zusaetzlicher Anmeldeweg neben Benutzername/Passwort. Der Login-Screen holt die konfigurierten Provider von GET /api/auth/oidc/providers; ohne Provider oder gegen einen aelteren Server bleibt der Screen unveraendert. Die App laeuft als Public Client: Authorization Code Flow mit PKCE in einem Chrome Custom Tab (nie ein WebView), ohne Client Secret. Das ID-Token wird anschliessend an POST /api/auth/oidc/exchange gegen ein Calendarr-Token getauscht; die Antwort hat dieselbe Form wie der Passwort-Login, sodass der bestehende Session-Pfad unveraendert weiterlaeuft. - OidcAuthenticator kapselt Discovery, PKCE-Request und Code-Tausch. - Die angefragten Scopes kommen vom Server (mobile_scopes) — ein Scope, den der Provider nicht kennt, wuerde die ganze Anfrage scheitern lassen. - AuthState mit dem Refresh-Token liegt in den EncryptedSharedPreferences, nie im Klartext, und wird beim Logout mitgeloescht. - Provider und Client-ID werden vor dem Browser-Start persistiert, weil der Custom Tab in einer eigenen Task laeuft und dieser Prozess dabei getoetet werden kann; der Nonce kommt aus AuthorizationResponse.request, das AppAuth ueber den Redirect zurueckreicht. - Abbruch im Browser meldet AppAuth als regulaeres Ergebnis mit USER_CANCELED_AUTH_FLOW und wird still behandelt, nicht als Fehler. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
131 lines
4.7 KiB
Kotlin
131 lines
4.7 KiB
Kotlin
import java.io.FileInputStream
|
|
import java.util.Properties
|
|
|
|
plugins {
|
|
id("com.android.application") version "8.10.0"
|
|
id("org.jetbrains.kotlin.android") version "1.9.20"
|
|
id("org.jetbrains.kotlin.kapt") version "1.9.20"
|
|
id("com.google.dagger.hilt.android") version "2.49"
|
|
}
|
|
|
|
// Release signing is driven by a git-ignored keystore.properties in the repo
|
|
// root (see keystore.properties.example). Absent (e.g. CI / fresh clone) the
|
|
// release build simply stays unsigned — debug builds are unaffected.
|
|
val keystorePropsFile = rootProject.file("keystore.properties")
|
|
val keystoreProps = Properties().apply {
|
|
if (keystorePropsFile.exists()) FileInputStream(keystorePropsFile).use { load(it) }
|
|
}
|
|
|
|
android {
|
|
namespace = "com.scarriffle.calendarr"
|
|
compileSdk = 35
|
|
|
|
defaultConfig {
|
|
applicationId = "com.scarriffle.calendarr"
|
|
minSdk = 24
|
|
targetSdk = 35
|
|
versionCode = 2
|
|
versionName = "1.1.0"
|
|
|
|
testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
|
|
vectorDrawables { useSupportLibrary = true }
|
|
|
|
// AppAuth merges its RedirectUriReceiverActivity into the manifest and
|
|
// needs the custom scheme for the OIDC redirect. Reverse-DNS on the
|
|
// application id, per RFC 8252; the same value must be registered as a
|
|
// redirect URI in the identity provider:
|
|
// com.scarriffle.calendarr:/oauth2redirect
|
|
manifestPlaceholders["appAuthRedirectScheme"] = "com.scarriffle.calendarr"
|
|
}
|
|
|
|
signingConfigs {
|
|
if (keystorePropsFile.exists()) {
|
|
create("release") {
|
|
storeFile = file(keystoreProps.getProperty("storeFile"))
|
|
storePassword = keystoreProps.getProperty("storePassword")
|
|
keyAlias = keystoreProps.getProperty("keyAlias")
|
|
keyPassword = keystoreProps.getProperty("keyPassword")
|
|
}
|
|
}
|
|
}
|
|
|
|
buildTypes {
|
|
release {
|
|
isMinifyEnabled = false
|
|
proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
|
|
if (keystorePropsFile.exists()) {
|
|
signingConfig = signingConfigs.getByName("release")
|
|
}
|
|
}
|
|
}
|
|
|
|
compileOptions {
|
|
sourceCompatibility = JavaVersion.VERSION_17
|
|
targetCompatibility = JavaVersion.VERSION_17
|
|
isCoreLibraryDesugaringEnabled = true
|
|
}
|
|
kotlinOptions {
|
|
jvmTarget = "17"
|
|
}
|
|
|
|
buildFeatures {
|
|
compose = true
|
|
}
|
|
|
|
composeOptions {
|
|
kotlinCompilerExtensionVersion = "1.5.5"
|
|
}
|
|
|
|
packaging {
|
|
resources {
|
|
excludes += setOf("/META-INF/{AL2.0,LGPL2.1}")
|
|
}
|
|
}
|
|
}
|
|
|
|
dependencies {
|
|
coreLibraryDesugaring("com.android.tools:desugar_jdk_libs:2.0.4")
|
|
implementation("androidx.core:core-ktx:1.12.0")
|
|
implementation("androidx.core:core-splashscreen:1.0.1")
|
|
implementation("com.google.android.material:material:1.11.0")
|
|
implementation("androidx.lifecycle:lifecycle-runtime-ktx:2.7.0")
|
|
implementation("androidx.lifecycle:lifecycle-viewmodel-compose:2.7.0")
|
|
implementation("androidx.activity:activity-compose:1.9.0")
|
|
|
|
// Compose (managed by BOM)
|
|
implementation(platform("androidx.compose:compose-bom:2023.10.01"))
|
|
implementation("androidx.compose.ui:ui")
|
|
implementation("androidx.compose.ui:ui-tooling-preview")
|
|
implementation("androidx.compose.material3:material3")
|
|
implementation("androidx.compose.material3:material3-window-size-class")
|
|
implementation("androidx.compose.material:material-icons-extended")
|
|
debugImplementation("androidx.compose.ui:ui-tooling")
|
|
|
|
// DI
|
|
implementation("androidx.hilt:hilt-navigation-compose:1.2.0")
|
|
implementation("com.google.dagger:hilt-android:2.49")
|
|
kapt("com.google.dagger:hilt-compiler:2.49")
|
|
|
|
// Networking
|
|
implementation("com.squareup.retrofit2:retrofit:2.11.0")
|
|
implementation("com.squareup.retrofit2:converter-moshi:2.11.0")
|
|
implementation("com.squareup.okhttp3:okhttp:4.12.0")
|
|
implementation("com.squareup.okhttp3:logging-interceptor:4.12.0")
|
|
implementation("com.squareup.moshi:moshi-kotlin:1.15.0")
|
|
|
|
// Secure credential storage
|
|
implementation("androidx.security:security-crypto:1.1.0-alpha06")
|
|
|
|
// OIDC / SSO — Authorization Code Flow with PKCE in a Custom Tab
|
|
implementation("net.openid:appauth:0.11.1")
|
|
|
|
// Async
|
|
implementation("org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3")
|
|
|
|
testImplementation("junit:junit:4.13.2")
|
|
androidTestImplementation("androidx.test.ext:junit:1.1.5")
|
|
androidTestImplementation("androidx.test.espresso:espresso-core:3.5.1")
|
|
androidTestImplementation(platform("androidx.compose:compose-bom:2023.10.01"))
|
|
androidTestImplementation("androidx.compose.ui:ui-test-junit4")
|
|
}
|