Closed
Conversation
Remove password login, webview login, registration, and TOTP flows. The login page now shows only the server URL input, a single "Login or sign up" button that launches the OAuth browser flow, and the ignore certificates checkbox.
kolaente
commented
Feb 26, 2026
| // Persist tokens | ||
| final settingsRepo = ref.read(settingsRepositoryProvider); | ||
| await settingsRepo.saveUserToken(tokens.accessToken); | ||
| await settingsRepo.saveRefreshToken(tokens.refreshToken); |
Member
Author
There was a problem hiding this comment.
These tokens should be treated like credentials and stored as secrets
| final challenge = OAuthDataSource.generateCodeChallenge(verifier); | ||
|
|
||
| // Manually compute expected: base64url(sha256(verifier)) without padding | ||
| final digest = sha256.convert(utf8.encode(verifier)); |
Member
Author
There was a problem hiding this comment.
this test does not seem like it's actually good. it seems to duplicate the logic of the code it's testing?
These files are no longer needed after simplifying the login page to OAuth-only.
Only used by the now-deleted webview login flow.
Member
Author
|
Replaced by #253 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
onBeforeRequesthook inClient, with serialized concurrent refresh handlingChanges
New files
lib/data/data_sources/oauth_data_source.dart— PKCE generation, authorization URL builder, token exchange/refresh via form-encoded HTTPlib/data/models/oauth_token_response.dart— OAuth token response DTOtest/oauth_data_source_test.dart— Tests for PKCE and URL builder (8 tests)test/settings_datasource_oauth_test.dart— Tests for new storage methods (8 tests)Modified files
pubspec.yaml— Addedcryptoandapp_linksdependenciesAndroidManifest.xml/Info.plist— Registeredvikunja://callbackdeep link schemesettings_data_source.dart/settings_repository.dart/settings_repository_impl.dart— Added refresh token, token expiry, and auth type storageclient.dart— Addedtokensetter andonBeforeRequesthook (1 new test)network_provider.dart— AddedOAuthTokenManagernotifier,AuthData.updateToken(), wired refresh intoClientProviderdata_source_provider.dart— AddedoAuthDataSourceproviderlogin_page.dart— OAuth button, deep link listener, PKCE flow, callback handler, auth-type persistenceinit_page.dart— OAuth session restoration with token refresh on cold startTest plan