From 6c022c0167dfc01a2fffe34e238e0cc1c5103701 Mon Sep 17 00:00:00 2001
From: Owais Jamil <desertthunder.dev@gmail.com>
Date: Fri, 22 May 2026 14:39:04 -0500
Subject: [PATCH] fix: android oauth callback default scheme

---
 android/app/src/main/AndroidManifest.xml      |  2 +-
 lib/features/auth/data/auth_repository.dart   |  8 +++-
 .../auth/data/auth_repository_test.dart       | 48 +++++++++++++++++++
 3 files changed, 55 insertions(+), 3 deletions(-)

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 49baad8..4e26ff4 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -57,7 +57,7 @@
                 <data
                     android:scheme="https"
                     android:host="lazurite.stormlightlabs.org"
-                    android:path="/oauth/callback" />
+                    android:pathPrefix="/oauth/callback" />
             </intent-filter>
         </activity>
         <!-- Don't delete the meta-data below.
diff --git a/lib/features/auth/data/auth_repository.dart b/lib/features/auth/data/auth_repository.dart
index c935d3e..c01d4bd 100644
--- a/lib/features/auth/data/auth_repository.dart
+++ b/lib/features/auth/data/auth_repository.dart
@@ -113,7 +113,7 @@ class AuthRepository {
   static const String _httpsOAuthRedirectPath = '/oauth/callback';
   static const bool _androidHttpsCallbackEnabled = bool.fromEnvironment(
     'OAUTH_ANDROID_HTTPS_CALLBACK_ENABLED',
-    defaultValue: true,
+    defaultValue: false,
   );
   static const bool _iosHttpsCallbackEnabled = bool.fromEnvironment(
     'OAUTH_IOS_HTTPS_CALLBACK_ENABLED',
@@ -1036,7 +1036,11 @@ class AuthRepository {
   bool _isSupportedHttpsRedirect(Uri redirectUri) {
     return redirectUri.scheme == 'https' &&
         redirectUri.host == _httpsOAuthRedirectHost &&
-        redirectUri.path == _httpsOAuthRedirectPath;
+        _isSupportedHttpsRedirectPath(redirectUri.path);
+  }
+
+  bool _isSupportedHttpsRedirectPath(String path) {
+    return path == _httpsOAuthRedirectPath || path == '$_httpsOAuthRedirectPath/';
   }
 
   @visibleForTesting
diff --git a/test/features/auth/data/auth_repository_test.dart b/test/features/auth/data/auth_repository_test.dart
index 2b2979a..0032724 100644
--- a/test/features/auth/data/auth_repository_test.dart
+++ b/test/features/auth/data/auth_repository_test.dart
@@ -27,6 +27,10 @@ void main() {
     registerFallbackValue(FakeAccountsCompanion());
   });
 
+  tearDown(() {
+    debugDefaultTargetPlatformOverride = null;
+  });
+
   setUp(() {
     mockDatabase = MockAppDatabase();
     mockSlingshotClient = MockSlingshotClient();
@@ -1463,6 +1467,21 @@ void main() {
         expect(normalized.queryParameters['state'], equals('xyz'));
       });
 
+      test('accepts hosted HTTPS callback URI after static host trailing slash redirect', () {
+        final normalized = authRepository.normalizeOAuthCallbackUri(
+          Uri.parse(
+            'https://lazurite.stormlightlabs.org/oauth/callback/?code=abc&state=xyz&iss=https%3A%2F%2Fbsky.social',
+          ),
+        );
+
+        expect(normalized, isNotNull);
+        expect(normalized!.scheme, equals('https'));
+        expect(normalized.host, equals('lazurite.stormlightlabs.org'));
+        expect(normalized.path, equals('/oauth/callback/'));
+        expect(normalized.queryParameters['code'], equals('abc'));
+        expect(normalized.queryParameters['state'], equals('xyz'));
+      });
+
       test('rejects HTTPS callback URI with unexpected host', () {
         final normalized = authRepository.normalizeOAuthCallbackUri(
           Uri.parse('https://example.com/oauth/callback?code=abc&state=xyz'),
@@ -1513,6 +1532,35 @@ void main() {
     });
 
     group('oauth redirect URI selection', () {
+      test('uses custom scheme callback by default on Android login', () async {
+        debugDefaultTargetPlatformOverride = TargetPlatform.android;
+        var sawAuthorize = false;
+        authRepository = AuthRepository(
+          database: mockDatabase,
+          loadClientMetadata: (_) async => _testClientMetadata(),
+          oauthServiceResolver: () => 'bsky.social',
+          resolveHandleDid: (_) async => 'did:plc:alice',
+          resolveDidDocument: (_) async => const {
+            'service': [
+              {
+                'id': '#atproto_pds',
+                'type': 'AtprotoPersonalDataServer',
+                'serviceEndpoint': 'https://bsky.social',
+              },
+            ],
+          },
+          resolveAuthorizationServiceForPdsHost: (_) async => null,
+          oauthAuthorizeSession: (client, identity) async {
+            sawAuthorize = true;
+            expect(client.metadata.redirectUris, equals(['org.stormlightlabs.lazurite:/oauth/callback']));
+            throw const OAuthException('stop after redirect assertion');
+          },
+        );
+
+        await expectLater(authRepository.loginWithOAuth('alice.bsky.social'), throwsA(isA<Exception>()));
+        expect(sawAuthorize, isTrue);
+      });
+
       test('prefers HTTPS callback on Android when flag is enabled', () {
         final selected = authRepository.selectOAuthRedirectUriTemplate(
           const ['org.stormlightlabs.lazurite:/oauth/callback', 'https://lazurite.stormlightlabs.org/oauth/callback'],
-- 
2.51.2