feat(base): SimpleLogin's sign-in comes back by the app's scheme or the loopback (ADR 0020, D9 corrected)

simpleLogin.begin takes the way back (SimpleLoginReturn: loopback,
scheme) rather than the platform, so macOS can come back through its
scheme as iOS and Android do; the markers become learn-loopback,
learn-scheme, todo-loopback and todo-scheme. Not breaking: the
endpoint has never been released.

D9 corrected by the developer after research: Android, iOS and macOS
come back through the app's scheme, Linux and Windows through the
loopback. Verified links protected nothing here: a code caught on its
way is worthless without the attempt's ID, and a hostile app beginning
an attempt of its own can ask for a way back that other platforms need
open. The ADR notes the residual risk and the check of prompt=consent
still to do. assetlinks.json stays served.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

packages/halkyon_base_client/lib/src/protocol/client.dart

@@ -58,8 +58,8 @@ import 'package:halkyon_base_client/src/protocol/profile/profile_refusal.dart'
     as _ih722tf9;
 import 'package:halkyon_base_client/src/protocol/simplelogin/simplelogin_completed.dart'
     as _ianfx7qj;
-import 'package:halkyon_base_client/src/protocol/simplelogin/simplelogin_platform.dart'
-    as _i32mw11n;
+import 'package:halkyon_base_client/src/protocol/simplelogin/simplelogin_return.dart'
+    as _ihc3njmr;
 import 'package:halkyon_oidc_client/halkyon_oidc_client.dart' as _ibkpwzgl;
 import 'package:serverpod_auth_core_client/serverpod_auth_core_client.dart'
     as _iacc;
@@ -901,16 +901,17 @@ class EndpointSimpleLogin extends _isc.EndpointRef {
   @override
   String get name => 'halkyon_base.simpleLogin';
 
-  /// Begins a sign-in from this server's app on [platform]: the attempt,
-  /// whose ID the device keeps to itself, and SimpleLogin's address to open
-  /// in the browser, which comes back through the forwarding page with a
-  /// code for [complete]. Refusals as `beginSimpleLogin`'s.
+  /// Begins a sign-in from this server's app, coming [back] by the loopback
+  /// or the app's scheme: the attempt, whose ID the device keeps to itself,
+  /// and SimpleLogin's address to open in the browser, which comes back
+  /// through the forwarding page with a code for [complete]. Refusals as
+  /// `beginSimpleLogin`'s.
   _ida.Future<_ibkpwzgl.OidcStart> begin({
-    required _i32mw11n.SimpleLoginPlatform platform,
+    required _ihc3njmr.SimpleLoginReturn back,
   }) => caller.callServerEndpoint<_ibkpwzgl.OidcStart>(
     'halkyon_base.simpleLogin',
     'begin',
-    {'platform': platform},
+    {'back': back},
   );
 
   /// Ends [attempt] with SimpleLogin's [code], as the caller began it:

packages/halkyon_base_client/lib/src/protocol/protocol.dart

@@ -55,7 +55,7 @@ import 'profile/profile_refusal.dart' as _i6j6efd1;
 import 'profile/profile_refused_exception.dart' as _idvc5e7p;
 import 'simplelogin/simplelogin_completed.dart' as _i51ry5s2;
 import 'simplelogin/simplelogin_outcome.dart' as _i5ar1hzl;
-import 'simplelogin/simplelogin_platform.dart' as _ivny5pkt;
+import 'simplelogin/simplelogin_return.dart' as _i8dcjd27;
 export 'auth/email_code_purpose.dart';
 export 'auth/email_sign_in_refusal.dart';
 export 'auth/email_sign_in_refused_exception.dart';
@@ -92,7 +92,7 @@ export 'profile/profile_refusal.dart';
 export 'profile/profile_refused_exception.dart';
 export 'simplelogin/simplelogin_completed.dart';
 export 'simplelogin/simplelogin_outcome.dart';
-export 'simplelogin/simplelogin_platform.dart';
+export 'simplelogin/simplelogin_return.dart';
 export 'client.dart';
 
 class Protocol extends _isc.SerializationManager {
@@ -248,8 +248,8 @@ class Protocol extends _isc.SerializationManager {
     if (t == _i5ar1hzl.SimpleLoginOutcome) {
       return _i5ar1hzl.SimpleLoginOutcome.fromJson(data) as T;
     }
-    if (t == _ivny5pkt.SimpleLoginPlatform) {
-      return _ivny5pkt.SimpleLoginPlatform.fromJson(data) as T;
+    if (t == _i8dcjd27.SimpleLoginReturn) {
+      return _i8dcjd27.SimpleLoginReturn.fromJson(data) as T;
     }
     if (t == _isc.getType<_ifpka2on.EmailCodePurpose?>()) {
       return (data != null ? _ifpka2on.EmailCodePurpose.fromJson(data) : null)
@@ -403,10 +403,8 @@ class Protocol extends _isc.SerializationManager {
       return (data != null ? _i5ar1hzl.SimpleLoginOutcome.fromJson(data) : null)
           as T;
     }
-    if (t == _isc.getType<_ivny5pkt.SimpleLoginPlatform?>()) {
-      return (data != null
-              ? _ivny5pkt.SimpleLoginPlatform.fromJson(data)
-              : null)
+    if (t == _isc.getType<_i8dcjd27.SimpleLoginReturn?>()) {
+      return (data != null ? _i8dcjd27.SimpleLoginReturn.fromJson(data) : null)
           as T;
     }
     if (t == Set<String>) {
@@ -480,7 +478,7 @@ class Protocol extends _isc.SerializationManager {
       _idvc5e7p.ProfileRefusedException => 'ProfileRefusedException',
       _i51ry5s2.SimpleLoginCompleted => 'SimpleLoginCompleted',
       _i5ar1hzl.SimpleLoginOutcome => 'SimpleLoginOutcome',
-      _ivny5pkt.SimpleLoginPlatform => 'SimpleLoginPlatform',
+      _i8dcjd27.SimpleLoginReturn => 'SimpleLoginReturn',
       _ => null,
     };
   }
@@ -570,8 +568,8 @@ class Protocol extends _isc.SerializationManager {
         return 'SimpleLoginCompleted';
       case _i5ar1hzl.SimpleLoginOutcome():
         return 'SimpleLoginOutcome';
-      case _ivny5pkt.SimpleLoginPlatform():
-        return 'SimpleLoginPlatform';
+      case _i8dcjd27.SimpleLoginReturn():
+        return 'SimpleLoginReturn';
     }
     return null;
   }
@@ -690,8 +688,8 @@ class Protocol extends _isc.SerializationManager {
     if (dataClassName == 'SimpleLoginOutcome') {
       return deserialize<_i5ar1hzl.SimpleLoginOutcome>(data['data']);
     }
-    if (dataClassName == 'SimpleLoginPlatform') {
-      return deserialize<_ivny5pkt.SimpleLoginPlatform>(data['data']);
+    if (dataClassName == 'SimpleLoginReturn') {
+      return deserialize<_i8dcjd27.SimpleLoginReturn>(data['data']);
     }
     return super.deserializeByClassName(data);
   }

packages/halkyon_base_client/lib/src/protocol/simplelogin/simplelogin_return.dart

@@ -0,0 +1,40 @@
+/* AUTOMATICALLY GENERATED CODE DO NOT MODIFY */
+/*   To generate run: "serverpod generate"    */
+
+// ignore_for_file: implementation_imports
+// ignore_for_file: library_private_types_in_public_api
+// ignore_for_file: non_constant_identifier_names
+// ignore_for_file: public_member_api_docs
+// ignore_for_file: type_literal_in_constant_pattern
+// ignore_for_file: use_super_parameters
+// ignore_for_file: invalid_use_of_internal_member
+
+// ignore_for_file: no_leading_underscores_for_library_prefixes
+import 'package:serverpod_client/serverpod_client.dart' as _isc;
+
+/// How an app comes back from a SimpleLogin sign-in (ADR 0020, 3 and D9),
+/// which says where the forwarding page sends it: the loopback (Linux,
+/// Windows) or the app's scheme (Android, iOS, macOS).
+enum SimpleLoginReturn implements _isc.SerializableModel {
+  loopback,
+  scheme;
+
+  static SimpleLoginReturn fromJson(String name) {
+    switch (name) {
+      case 'loopback':
+        return SimpleLoginReturn.loopback;
+      case 'scheme':
+        return SimpleLoginReturn.scheme;
+      default:
+        throw ArgumentError(
+          'Value "$name" cannot be converted to "SimpleLoginReturn"',
+        );
+    }
+  }
+
+  @override
+  String toJson() => name;
+
+  @override
+  String toString() => name;
+}