Changeset bf72108 in Klonkt for test

Timestamp:

07/19/2026 04:04:25 AM (7 weeks ago)

Author:

Robin <roboburr@…>

Branches:

main

Children:

4407c67

Parents:

dd568e7

git-author:

Robin <roboburr@…> (07/19/2026 04:04:05 AM)

git-committer:

Robin <roboburr@…> (07/19/2026 04:04:25 AM)

Message:

Fix: OAuth consent hands off to native apps via an interstitial

After Allow/Deny the server 302-redirected to the client's redirect_uri. For a
native custom scheme (com.klonkt.shaer:/oauth) that 302 is silently dropped by
mobile browsers (no user gesture to launch an external app), so Allow/Deny
appeared to do nothing. finishRedirect() now keeps the 302 for http/https
clients but, for a non-http redirect_uri, serves a tiny interstitial that
meta/JS auto-forwards AND shows an 'Open the app' tap link — a tap is the user
gesture Android needs, and iOS's ASWebAuthenticationSession intercepts either
navigation. Used for both allow (code) and deny/error. Verified: native →
interstitial HTML with the code + tap link; https → still 302; deny → error in
the interstitial. 80 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

(No files)