docs(android): record the M9 Part 2 native-SSO app plan #24

wtclaude · 2026-07-20T22:54:19Z

wtclaude commented

2026-07-20 22:54:19 +00:00

What & why

Records the M9 Part 2 (native in-app SSO) app plan in android/PLAN.md before the code lands, mirroring the M7 plan-block style. Companion to the app PR RunicGateway/Android-app#16.

Changes

Adds an "M9 plan — native SSO login" block under §9:

the two-part, backend-first split (Part 1 backend + docs already landed; Part 2 is the app client);
the frozen Part-1 contract the app codes against — GET /auth/providers, the GET /auth/mobile/sso/start Custom-Tab redirect (exact-match redirect_uri allowlist), the ?code&state / ?error&state callback deep link, and POST /auth/mobile/sso/exchange → the shared mobile bearer pair;
the six Part-2 app work items: PKCE + CSRF state (Layer B), the SsoAuthManager orchestrator, SsoApi + DTOs, the runicgateway://auth/callback intent-filter, the login-screen provider list, and the JVM tests.

No behavior/protocol change — documentation only. Part 2 is app-only (custom scheme; App Links deferred per android/APP_LINKS.md).

AI disclosure

Authored with Claude Code (Claude Opus). Commit carries a Co-Authored-By: Claude trailer per org policy.

🤖 Generated with Claude Code

## What & why Records the **M9 Part 2** (native in-app SSO) app plan in `android/PLAN.md` before the code lands, mirroring the M7 plan-block style. Companion to the app PR **`RunicGateway/Android-app#16`**. ## Changes Adds an **"M9 plan — native SSO login"** block under §9: - the two-part, **backend-first** split (Part 1 backend + docs already landed; Part 2 is the app client); - the **frozen Part-1 contract** the app codes against — `GET /auth/providers`, the `GET /auth/mobile/sso/start` Custom-Tab redirect (exact-match `redirect_uri` allowlist), the `?code&state` / `?error&state` callback deep link, and `POST /auth/mobile/sso/exchange` → the shared mobile bearer pair; - the six **Part-2 app work items**: PKCE + CSRF state (Layer B), the `SsoAuthManager` orchestrator, `SsoApi` + DTOs, the `runicgateway://auth/callback` intent-filter, the login-screen provider list, and the JVM tests. No behavior/protocol change — documentation only. Part 2 is app-only (custom scheme; App Links deferred per `android/APP_LINKS.md`). ## AI disclosure Authored with **Claude Code** (Claude Opus). Commit carries a `Co-Authored-By: Claude` trailer per org policy. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-20 22:54:20 +00:00

docs(android): record the M9 Part 2 native-SSO app plan 44544dc3bc

Add the "M9 plan — native SSO login" block to android/PLAN.md: the two-part
(backend-first) split, the frozen Part-1 bridge contract the app codes against
(/auth/providers, /auth/mobile/sso/start Custom-Tab redirect, the code/error
callback deep link, /auth/mobile/sso/exchange), and the six Part-2 app work
items (PKCE+state, SsoAuthManager, SsoApi+DTOs, the callback intent-filter,
the login-screen provider list, and the JVM tests).

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

whitlocktech merged commit 82d88f26ec into main

2026-07-20 22:56:29 +00:00

whitlocktech deleted branch docs/m9-native-sso-part2

2026-07-20 22:56:29 +00:00

whitlocktech referenced this issue from a commit

2026-07-20 22:56:30 +00:00

Merge pull request 'docs(android): record the M9 Part 2 native-SSO app plan' (#24) from docs/m9-native-sso-part2 into main

wtclaude referenced this pull request

2026-07-20 23:39:40 +00:00

docs(android): spec Android App Links (assetlinks.json + build-time host) #25

Sign in to join this conversation.