Skip to content

Closed - #12

Closed
tygoegmond wants to merge 1 commit into
mainfrom
feat/auth-web-session
Closed

tygoegmond wants to merge 1 commit into
mainfrom
feat/auth-web-session

Conversation

@tygoegmond

@tygoegmond tygoegmond commented Oct 16, 2026 •

Copy link
Copy Markdown
Contributor

Closed.

… sheet

Google refuses to sign in inside an embedded web view, so the page asks the
shell to open core's sign-in hop in the system's sign-in sheet
(`auth.webSession { url }` → `{ callbackUrl }`, PROTOCOL.md §7.1). The sheet
closes on the plugchoice-link scheme and the URL goes back to the page.

- iOS: ASWebAuthenticationSession with callback scheme plugchoice-link,
  sharing Safari's cookies. Listed always; the host app needs nothing.
- Android: Chrome's Auth Tab (androidx.browser 1.9 AuthTabIntent), which
  answers the activity that opened it, so no intent filter and no app
  competes for the scheme. Listed only when the browser supports Auth Tab;
  a <queries> entry lets the library find a Custom Tabs browser.

The callback URL holds a one-time code that is worth nothing without the
run's credential; shells never log it.
@tygoegmond tygoegmond changed the title feat: auth.webSession, Google and Apple sign-in in the system sign-in sheet Closed Oct 16, 2026
@tygoegmond tygoegmond closed this Oct 16, 2026
@tygoegmond
tygoegmond deleted the feat/auth-web-session branch October 16, 2026 13:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant