Add home navigation drawer, FHIR sync, and OIDC/PKCE login

README.md

@@ -35,6 +35,51 @@ Code generation is part of compilation. The `ig-codegen` Gradle plugin runs its
 
 For iOS, open [`iosApp/`](./iosApp) in Xcode and run, or use the run-configuration widget in a Kotlin Multiplatform IDE.
 
+## Identity provider (OIDC) configuration
+
+Sign-in is provider-agnostic. The client speaks standard OpenID Connect and resolves every endpoint — authorization, token, userinfo, and end-session — at runtime from the provider's discovery document at `{issuer}/.well-known/openid-configuration`. Nothing is hardcoded per provider, so switching from one OAuth2/OIDC provider to another is a configuration change, not a code change: point `OAUTH_ISSUER` at the new provider (and update the client id, scopes, and redirect registration to match). See [`OidcAuthApi`](./ohs-player-reference-app/src/commonMain/kotlin/dev/ohs/player/reference/app/auth/OidcAuthApi.kt) and [`OAuthConfig`](./ohs-player-reference-app/src/commonMain/kotlin/dev/ohs/player/reference/app/auth/OAuthConfig.kt).
+
+The flow is Authorization Code with PKCE and a `state` check. The provider must therefore expose the client as a **public client** (no client secret) that permits PKCE, and the app's redirect URIs must be registered as allowed redirects. Any standards-compliant OIDC provider — Keycloak, Okta, Zitadel, and others — works under these constraints.
+
+### Configure a provider
+
+1. Register a public (PKCE) client at your provider and note its client id.
+2. Register the per-platform redirect URIs below as allowed redirect URIs.
+3. Copy `local.properties.sample` to `local.properties` and fill in the keys below. The file is git-ignored; CI may override any key with an environment variable of the same name.
+
+Configuration is read at build time by the `generateAuthConfig` task and baked into `GeneratedAuthConfig`, which backs `OAuthConfig.Default`.
+
+| Key | Meaning | Example |
+| --- | --- | --- |
+| `OAUTH_ISSUER` | OIDC issuer; discovery is performed against `{issuer}/.well-known/openid-configuration` | `https://keycloak.example.org/realms/ohs-player` |
+| `OAUTH_CLIENT_ID` | Public client id (PKCE, no secret) | `ohs-player-reference-app` |
+| `OAUTH_SCOPES` | Space-separated scopes; `offline_access` yields a refresh token | `openid profile email offline_access` |
+| `OAUTH_REDIRECT_SCHEME` | Custom URI scheme for the mobile deep-link redirect | `dev.ohs.player.reference.app` |
+| `OAUTH_REDIRECT_HOST` | Host component of the mobile redirect | `auth` |
+| `OAUTH_DESKTOP_REDIRECT_PORT` | Localhost loopback port for the desktop (JVM) redirect | `8765` |
+| `OAUTH_WEB_REDIRECT_URL` | Full-page redirect URL for the web (JS/Wasm) build | `http://localhost:8080/callback` |
+| `FHIR_BASE_URL` | Base URL of the FHIR server; requests carry the session Bearer token | `https://hapi.fhir.org/baseR4` |
+
+### Issuer examples
+
+The issuer is the only value that identifies the provider. Note that for Keycloak the realm is part of the issuer.
+
+| Provider | `OAUTH_ISSUER` |
+| --- | --- |
+| Keycloak | `https://host/realms/<realm>` |
+| Okta | `https://<org>.okta.com` (or a custom authorization server, `https://<org>.okta.com/oauth2/<server-id>`) |
+| Zitadel | `https://<instance>.zitadel.cloud` |
+
+### Redirect URIs to register
+
+Each platform completes the authorization redirect differently, so register all of the ones you build for:
+
+| Platform | Redirect URI | Derived from |
+| --- | --- | --- |
+| Android / iOS | `{OAUTH_REDIRECT_SCHEME}://{OAUTH_REDIRECT_HOST}` | e.g. `dev.ohs.player.reference.app://auth` |
+| Desktop (JVM) | `http://127.0.0.1:{OAUTH_DESKTOP_REDIRECT_PORT}/callback` (also register the `http://localhost:...` form) | loopback port |
+| Web (JS/Wasm) | `OAUTH_WEB_REDIRECT_URL` | e.g. `http://localhost:8080/callback` |
+
 ## From FHIR data to view state
 
 A screen never consumes a raw FHIR resource. It consumes a typed *view-state* — a flat, serializable data class containing exactly the fields the screen needs. View-state is produced by a configuration-driven pipeline:

gradle.properties

@@ -15,3 +15,6 @@ android.useAndroidX=true
 
 #MPP
 kotlin.mpp.enableCInteropCommonization=true
+
+# Enabled parallel sync for Gradle 9.4+
+org.gradle.tooling.parallel=true

gradle/libs.versions.toml

@@ -9,13 +9,19 @@ androidx-core = "1.18.0"
 androidx-espresso = "3.7.0"
 androidx-lifecycle = "2.10.0"
 androidx-testExt = "1.3.0"
+androidx-work = "2.8.1"
 composeHotReload = "1.1.1"
 composeMultiplatform = "1.11.0"
 composeMaterialIcons = "1.7.3"
 fhirDataCapture = "2.0.0-alpha02"
 junit = "4.13.2"
 kermit = "2.1.0"
 koinBom = "4.1.1"
+ktor = "3.2.3"
+ksafe = "2.1.3"
+kotlincryptoHash = "0.8.0"
+androidxBrowser = "1.8.0"
+kotlinxBrowser = "0.3"
 kotlin = "2.3.21"
 kotlinx-coroutines = "1.11.0"
 kotlinpoet = "2.3.0"
@@ -24,9 +30,10 @@ ktfmt = "0.54"
 ktlint = "1.5.0"
 navigation-compose = "2.9.2"
 material3 = "1.10.0-alpha05"
+composeAdaptive = "1.2.0"
 kotlinxSerializationJson = "1.11.0"
 spotless = "8.6.0"
-ohsFhirEngine   = "2.0.0-alpha01"
+ohsFhirEngine   = "2.0.0-alpha02"
 ohsFhirModel    = "1.0.0-beta05"
 ohsFhirPath     = "1.0.0-beta03"
 kotlinxDatetime = "0.8.0"
@@ -36,6 +43,7 @@ ionspin-bignum = "0.3.10"
 fhir-data-capture = { module = "dev.ohs.fhir:fhir-data-capture", version.ref = "fhirDataCapture" }
 kermit = { module = "co.touchlab:kermit", version.ref = "kermit" }
 koin-bom = { module = "io.insert-koin:koin-bom", version.ref = "koinBom" }
+koin-test = { module = "io.insert-koin:koin-test" }
 koin-core = { module = "io.insert-koin:koin-core" }
 koin-compose = { module = "io.insert-koin:koin-compose" }
 koin-composeViewmodel = { module = "io.insert-koin:koin-compose-viewmodel" }
@@ -54,6 +62,10 @@ compose-runtime = { module = "org.jetbrains.compose.runtime:runtime", version.re
 compose-foundation = { module = "org.jetbrains.compose.foundation:foundation", version.ref = "composeMultiplatform" }
 compose-material = { module = "org.jetbrains.compose.material:material", version.ref = "composeMultiplatform" }
 compose-material3 = { module = "org.jetbrains.compose.material3:material3", version.ref = "material3" }
+compose-adaptive = { module = "org.jetbrains.compose.material3.adaptive:adaptive", version.ref = "composeAdaptive" }
+compose-adaptive-layout = { module = "org.jetbrains.compose.material3.adaptive:adaptive-layout", version.ref = "composeAdaptive" }
+compose-adaptive-navigation = { module = "org.jetbrains.compose.material3.adaptive:adaptive-navigation", version.ref = "composeAdaptive" }
+compose-material3-adaptive-navigation-suite = { module = "org.jetbrains.compose.material3:material3-adaptive-navigation-suite", version.ref = "material3" }
 compose-materialIconsCore = { module = "org.jetbrains.compose.material:material-icons-core", version.ref = "composeMaterialIcons" }
 compose-ui = { module = "org.jetbrains.compose.ui:ui", version.ref = "composeMultiplatform" }
 compose-components-resources = { module = "org.jetbrains.compose.components:components-resources", version.ref = "composeMultiplatform" }
@@ -70,6 +82,21 @@ ohs-fhir-model = { module = "dev.ohs.fhir:fhir-model", version.ref = "ohsFhirMod
 ohs-fhir-path = { module = "dev.ohs.fhir:fhir-path", version.ref = "ohsFhirPath" }
 ionspin-bignum = { module = "com.ionspin.kotlin:bignum", version.ref = "ionspin-bignum" }
 spotless = { module = "com.diffplug.spotless:spotless-plugin-gradle", version.ref = "spotless" }
+ktor-client-core = { module = "io.ktor:ktor-client-core", version.ref = "ktor" }
+ktor-client-auth = { module = "io.ktor:ktor-client-auth", version.ref = "ktor" }
+ktor-client-content-negotiation = { module = "io.ktor:ktor-client-content-negotiation", version.ref = "ktor" }
+ktor-serialization-kotlinx-json = { module = "io.ktor:ktor-serialization-kotlinx-json", version.ref = "ktor" }
+ktor-client-okhttp = { module = "io.ktor:ktor-client-okhttp", version.ref = "ktor" }
+ktor-client-cio = { module = "io.ktor:ktor-client-cio", version.ref = "ktor" }
+ktor-client-darwin = { module = "io.ktor:ktor-client-darwin", version.ref = "ktor" }
+ktor-client-js = { module = "io.ktor:ktor-client-js", version.ref = "ktor" }
+ktor-client-mock = { module = "io.ktor:ktor-client-mock", version.ref = "ktor" }
+ksafe = { module = "eu.anifantakis:ksafe", version.ref = "ksafe" }
+androidx-browser = { module = "androidx.browser:browser", version.ref = "androidxBrowser" }
+androidx-work-runtime = { module = "androidx.work:work-runtime-ktx", version.ref = "androidx-work" }
+kotlincrypto-hash-bom = { module = "org.kotlincrypto.hash:bom", version.ref = "kotlincryptoHash" }
+kotlincrypto-hash-sha2 = { module = "org.kotlincrypto.hash:sha2" }
+kotlinx-browser = { module = "org.jetbrains.kotlinx:kotlinx-browser", version.ref = "kotlinxBrowser" }
 
 [plugins]
 androidApplication = { id = "com.android.application", version.ref = "agp" }

iosApp/iosApp/Info.plist

@@ -2,7 +2,17 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
+	<key>CFBundleDisplayName</key>
+	<string>Player Reference</string>
 	<key>CADisableMinimumFrameDurationOnPhone</key>
 	<true/>
+	<key>BGTaskSchedulerPermittedIdentifiers</key>
+	<array>
+		<string>dev.ohs.player.reference.app.sync.periodic</string>
+	</array>
+	<key>UIBackgroundModes</key>
+	<array>
+		<string>processing</string>
+	</array>
 </dict>
 </plist>

local.properties.sample

@@ -0,0 +1,33 @@
+# ---------------------------------------------------------------------------
+# local.properties.sample — copy to `local.properties` and fill in your values.
+# `local.properties` is git-ignored. These are read at build time by the
+# :ohs-player-reference-app `generateAuthConfig` task. CI may override any of
+# these with environment variables of the same name.
+#
+# PKCE uses a PUBLIC client, so there is NO client secret here.
+# ---------------------------------------------------------------------------
+
+# --- OAuth / OIDC provider ---------------------------------------------------
+# Provider-agnostic: the app resolves all endpoints via OIDC discovery at
+# {OAUTH_ISSUER}/.well-known/openid-configuration.
+#   Keycloak: https://host/realms/<realm>   (the realm IS part of the issuer)
+OAUTH_ISSUER=https://keycloak.example.org/realms/ohs-player
+# Public client id (PKCE / public client — no secret).
+OAUTH_CLIENT_ID=ohs-player-reference-app
+# OAuth scopes (space separated). offline_access yields a refresh token.
+OAUTH_SCOPES=openid profile email offline_access
+
+# --- Redirect URIs (must be registered as Valid Redirect URIs at the provider) ---
+# Android + iOS use a custom URI scheme deep link: {SCHEME}://{HOST}
+OAUTH_REDIRECT_SCHEME=dev.ohs.player.reference.app
+OAUTH_REDIRECT_HOST=auth
+# Desktop (JVM) uses a localhost loopback redirect on this port.
+# Register as: http://127.0.0.1:8765/callback (and http://localhost:8765/callback)
+OAUTH_DESKTOP_REDIRECT_PORT=8765
+# Web (JS/Wasm) uses a full-page redirect back to the app origin.
+OAUTH_WEB_REDIRECT_URL=http://localhost:8080/callback
+
+# --- FHIR server --------------------------------------------------------------
+# Base URL of the remote FHIR server. Requests are authenticated with the
+# signed-in session's Bearer token (see FhirBearerAuthenticator).
+FHIR_BASE_URL=https://hapi.fhir.org/baseR4