[RFR-265] Switch to OAuth (#54)

* [RFR-469] Add draft for oauth authentication

* Upgrade SDK to test version

* Remove unused code

* Attempt to merge TokenActivity into MainActivity

* Add debug messages

* WIP: fresh token is provided

* [RFR-519] Fix logout

* Add dummy implementation

* Update build.gradle

* [RFR-563] Inject oauth config

* Last working state for rfr UI

* Cleanup

* Fix build

* Disable Notification test

* Upgrade SDK to 7.8.0

.github/workflows/gradle_build.yml

@@ -48,9 +48,12 @@ jobs:
           echo "githubToken=${{ secrets.GH_READ_TOKEN }}" >> gradle.properties
           # This mock API accepts all credentials and allows the UI test to skip the login
           echo "cyface.staging_api=https://demo.cyface.de/api/v2" >> gradle.properties
-          echo "cyface.staging_auth_api=https://demo.cyface.de/api/v2" >> gradle.properties
+          echo "cyface.staging_incentives_api=https://demo.cyface.de/incentives" >> gradle.properties
+          echo "cyface.staging_oauth_discovery=https://demo.cyface.de/auth" >> gradle.properties
           echo "cyface.staging_user=guestLogin" >> gradle.properties
           echo "cyface.staging_password=guestPassword" >> gradle.properties
+          echo "cyface.oauth_redirect=de.cyface.app:/oauth2redirect" >> gradle.properties
+          echo "cyface.oauth_redirect.r4r=de.cyface.app.r4r:/oauth2redirect" >> gradle.properties
 
       # Executing build here on Ubuntu stack (1/10th costs of MacOS stack)
       # Not using "gradle build" as we don't want to run the tests of all dependencies (e.g. backend)

.github/workflows/gradle_connected-tests.yml

@@ -64,9 +64,12 @@ jobs:
         run: |
           # This mock API accepts all credentials and allows the UI test to skip the login
           echo "cyface.staging_api=https://demo.cyface.de/api/v2" >> gradle.properties
-          echo "cyface.staging_auth_api=https://demo.cyface.de/api/v2" >> gradle.properties
+          echo "cyface.staging_incentives_api=https://demo.cyface.de/incentives" >> gradle.properties
+          echo "cyface.staging_oauth_discovery=https://demo.cyface.de/auth" >> gradle.properties
           echo "cyface.staging_user=guestLogin" >> gradle.properties
           echo "cyface.staging_password=guestPassword" >> gradle.properties
+          echo "cyface.oauth_redirect=de.cyface.app:/oauth2redirect" >> gradle.properties
+          echo "cyface.oauth_redirect.r4r=de.cyface.app.r4r:/oauth2redirect" >> gradle.properties
 
       # Not executing build here on MacOS stack (10x costs, if private repository)
       # Not using "gradle build" as we don't want to run the tests of all dependencies (e.g. backend)

README.adoc

@@ -29,7 +29,7 @@ To download the Cyface libraries (SDK, Energy Settings, Camera Service):
 
 [arabic]
 * You need a Github account with read-access to these Github repositories
-* Create a https://github.com/settings/tokens[personal access token on Github] with "write:packages" permissions
+* Create a https://github.com/settings/tokens[personal access token on Github] with `read:packages` and `repo` permissions to download the sub-modules and `android-publish` dependency.
 * Copy `gradle.properties.template` to `gradle.properties` and adjust:
 +
 ....

build.gradle

@@ -55,7 +55,7 @@ ext {
      */
 
     // Cyface dependencies
-    cyfaceAndroidBackendVersion = "7.7.2" // Also update submodule commit ref
+    cyfaceAndroidBackendVersion = "7.8.0" // Also update submodule commit ref
     cyfaceUtilsVersion = "3.3.7"
     cyfaceEnergySettingsVersion = "3.3.3" // Also update submodule commit ref
     cyfaceCameraServiceVersion = "4.1.11" // Also update submodule commit ref
@@ -87,6 +87,8 @@ ext {
     materialDialogsVersion = "3.3.0"
     chartVersion = "v3.1.0"
     hCaptchaVersion = "3.8.1"
+    // Can't be a SDK dependency as `appAuthRedirectScheme` needs to be defined at build-time
+    appAuthVersion = "0.11.1" // Can't move to uploader lib because of dependency issues
 
     // Testing
     junitVersion = "1.1.5"

gradle.properties.template

@@ -31,28 +31,41 @@ android.nonTransitiveRClass=true
 
 android.builder.sdkDownload=true
 android.enableJetifier=false
+android.defaults.buildfeatures.buildconfig=true
+android.nonFinalResIds=false
 
 githubUser=
 githubToken=
 
-cyface.api=
-cyface.auth_api=
-cyface.incentives_api=
-
 google.maps_api_key=
 google.maps-api_key.r4r=
 
 hCaptcha.key=
 hCaptcha.key.r4r=
 
-cyface.demo_api=
-cyface.local_api=
-cyface.emulator_api=
+cyface.oauth_redirect=
+cyface.oauth_redirect.r4r=
+
+cyface.api=
+cyface.incentives_api=
+cyface.oauth_discovery=
 
 cyface.staging_api=
-cyface.staging_auth_api=
 cyface.staging_incentives_api=
+cyface.staging_oauth_discovery=
 cyface.staging_user=
 cyface.staging_password=
 
+cyface.demo_api=
+cyface.demo_incentives_api=
+cyface.demo_oauth_discovery=
+
+cyface.local_api=
+cyface.local_incentives_api=
+cyface.local_oauth_discovery=
+
+cyface.emulator_api=
+cyface.emulator_incentives_api=
+cyface.emulator_oauth_discovery=
+
 # keep an empty line at the end for the CI to inject new lines easily

ui/cyface/build.gradle

@@ -70,8 +70,19 @@ android {
         missingDimensionStrategy 'project', 'cyface'
         missingDimensionStrategy 'mode', 'full'
 
-        // Load Google Maps API key
-        manifestPlaceholders = [ googleMapsApiKey:"${project.findProperty('google.maps_api_key')}"]
+        // Placeholders for AndroidManifest.xml
+        manifestPlaceholders = [
+                // Load Google Maps API key
+                googleMapsApiKey:"${project.findProperty('google.maps_api_key')}",
+
+                // Define app link scheme for AppAuth redirect
+                // Ensure this is consistent with the redirect URI defined below in `oauthRedirect`
+                // or specify additional redirect URIs in AndroidManifest.xml
+                'appAuthRedirectScheme': 'de.cyface.app'
+        ]
+
+        // oauth redirect uri
+        buildConfigField "String", "oauthRedirect", "\"${project.findProperty('cyface.oauth_redirect')}\""
 
         // Load hCaptcha API key
         buildConfigField "String", "hCaptchaKey", "\"${project.findProperty('hCaptcha.key')}\""
@@ -86,26 +97,32 @@ android {
 
             // Phone - to local collector - ! only if iptables allow connection from outside
             //buildConfigField "String", "cyfaceServer", "\"${project.findProperty('cyface.local_api')}\""
+            //buildConfigField "String", "oauthDiscovery", "\"${project.findProperty('cyface.local_oauth_discovery')}\""
             //manifestPlaceholders = [usesCleartextTraffic:"true"]
 
             // Phone - to local production - ! only if iptables allow connection from outside
             // CertPathValidatorException: Trust anchor for certification path not found.
             //buildConfigField "String", "cyfaceServer", "\"${project.findProperty('cyface.local_production_api')}\""
+            //buildConfigField "String", "oauthDiscovery", "\"${project.findProperty('cyface.local_oauth_discovery')}\""
             //manifestPlaceholders = [usesCleartextTraffic:"false"]
 
             // EMULATOR - to local collector
             //buildConfigField "String", "cyfaceServer", "\"${project.findProperty('cyface.emulator_api')}\""
+            //buildConfigField "String", "oauthDiscovery", "\"${project.findProperty('cyface.emulator_oauth_discovery')}\""
             //manifestPlaceholders = [usesCleartextTraffic:"true"] // for local collector testing
 
             // Staging
             buildConfigField "String", "cyfaceServer", "\"${project.findProperty('cyface.staging_api')}\""
-            buildConfigField "String", "authServer", "\"${project.findProperty('cyface.staging_auth_api')}\""
+            buildConfigField "String", "incentivesServer", "\"${project.findProperty('cyface.staging_incentives_api')}\""
+            buildConfigField "String", "oauthDiscovery", "\"${project.findProperty('cyface.staging_oauth_discovery')}\""
             buildConfigField "String", "testLogin", "\"${project.findProperty('cyface.staging_user')}\""
             buildConfigField "String", "testPassword", "\"${project.findProperty('cyface.staging_password')}\""
             manifestPlaceholders = [usesCleartextTraffic:"false"]
 
             // MOCK-API - only supports login - used by UI test on CI
             //buildConfigField "String", "cyfaceServer", "\"${project.findProperty('cyface.demo_api')}\""
+            //buildConfigField "String", "incentivesServer", "\"${project.findProperty('cyface.demo_incentives_api')}\""
+            //buildConfigField "String", "oauthDiscovery", "\"${project.findProperty('cyface.demo_oauth_discovery')}\""
             //manifestPlaceholders = [usesCleartextTraffic:"false"] // for local collector testing
         }
         release {
@@ -116,7 +133,8 @@ android {
 
             // signingConfig is set by the CI
             buildConfigField "String", "cyfaceServer", "\"${project.findProperty('cyface.api')}\""
-            buildConfigField "String", "authServer", "\"${project.findProperty('cyface.auth_api')}\""
+            buildConfigField "String", "incentivesServer", "\"${project.findProperty('cyface.incentives_api')}\""
+            buildConfigField "String", "oauthDiscovery", "\"${project.findProperty('cyface.oauth_discovery')}\""
             manifestPlaceholders = [usesCleartextTraffic:"false"]
         }
     }
@@ -205,6 +223,9 @@ dependencies {
     // HCaptcha
     implementation "com.github.hcaptcha:hcaptcha-android-sdk:$rootProject.ext.hCaptchaVersion"
 
+    // OAuth 2.0 with OpenID Connect
+    implementation "net.openid:appauth:$rootProject.ext.appAuthVersion" // Move to uploader [RFR-581]
+
     // Cyface dependencies
     implementation "de.cyface:android-utils:$rootProject.ext.cyfaceUtilsVersion"
     implementation project(':datacapturing')

ui/cyface/src/androidTest/kotlin/de/cyface/app/CapturingNotificationTest.kt

@@ -34,6 +34,7 @@ import org.hamcrest.CoreMatchers
 import org.hamcrest.MatcherAssert
 import org.hamcrest.Matchers
 import org.junit.Before
+import org.junit.Ignore
 import org.junit.Rule
 import org.junit.Test
 import org.junit.runner.RunWith
@@ -104,6 +105,7 @@ class CapturingNotificationTest {
      * This test is flaky on the Bitrise CI.
      */
     @Test
+    @Ignore("OAuth needs to be skipped [RFR-587]")
     fun test() {
         val context = InstrumentationRegistry.getInstrumentation().targetContext
 

ui/cyface/src/main/AndroidManifest.xml

@@ -45,13 +45,15 @@
     <!-- allowBackup=false as we did not yet define what we really want to backup-->
     <!-- usesCleartextTraffic only API 23+, ignored below. only for debugging -->
     <!-- tools:ignore = UnusedAttribute required to ignore Lint warning (usesCleartextTraffic) -->
+    <!-- tools:replace="android:usesCleartextTraffic" required when testing against local collector -->
     <application
         android:name=".MeasuringClient"
         android:allowBackup="false"
         android:icon="@mipmap/ic_logo"
         android:label="@string/app_name"
         android:theme="@style/AppTheme"
         tools:ignore="GoogleAppIndexingWarning,UnusedAttribute"
+        tools:replace="android:usesCleartextTraffic"
         android:usesCleartextTraffic="${usesCleartextTraffic}">
 
         <!-- Sentry DSN. This ids the account but is not a secret. -->
@@ -81,22 +83,21 @@
             </intent-filter>
         </activity>
 
+        <!-- See https://github.com/openid/AppAuth-Android/blob/master/app/AndroidManifest.xml
+        for more details on how to handle AppAuth redirects and app links. Activity is called by LoginActivity. -->
         <activity
             android:name=".MainActivity"
+            android:exported="true"
             android:launchMode="singleTop"> <!-- needed so that we don't have "two activities" when opening the activity via the notification bar and hitting the back button -->
         </activity>
 
         <!-- The LoginActivity automatically launched by the SDK's CyfaceAuthenticator -->
         <activity
-            android:name=".LoginActivity"
+            android:name=".auth.LoginActivity"
             android:label="@string/title_activity_login"
+            android:exported="false"
             android:launchMode="singleTask" /> <!-- when we switch back from Registration, see https://stackoverflow.com/a/45292292/5815054 -->
 
-        <!-- The RegistrationActivity can be launched via (on top of) the LoginActivity -->
-        <activity
-            android:name=".RegistrationActivity"
-            android:label="@string/sign_up" />
-
         <!-- This overwrites the provider in the SDK. This way the app can be installed next to other SDK using apps -->
         <!-- But we replaced the Content Provider with a Stub Content provider. -->
         <provider

ui/cyface/src/main/kotlin/de/cyface/app/CapturingFragment.kt

@@ -212,8 +212,7 @@ class CapturingFragment : Fragment(), ConnectionStatusListener {
             requireActivity().supportFragmentManager.findFragmentById(R.id.nav_host_fragment) as NavHostFragment
         requireActivity().addMenuProvider(
             MenuProvider(
-                capturing,
-                requireActivity(),
+                requireActivity() as MainActivity,
                 navHostFragment.navController
             ),
             viewLifecycleOwner,