halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

feat(base): SimpleLogin's forwarding page and Learn's App Links statement (ADR 0020, step 1)

Browse source 
SimpleLogin takes only https redirect addresses, each registered exactly,
so the instance's SimpleLogin app registers one page on the register's
web server, /simplelogin-callback, which sends the browser on to the app
that began the sign-in: a 303 to the desktop's loopback (127.0.0.1, a port
per app) or the phone's scheme, chosen by the marker the state begins with
(`<app>-<platform>.<rest>`, the rest 1 to 512 characters of base64url),
from a fixed table, so it sends nobody anywhere else. It forwards the code
or SimpleLogin's error (`deny`) with the state and nothing else, refuses
anything malformed, repeated or not a GET with a page that repeats nothing
it was given, and keeps and logs nothing (no-store, no referrer). It is
built ahead of the sign-in itself so development can sign in through
learn.halkyon.eu's page, which the development app registers too.

Android's assetlinks.json for Halkyon Learn signed with the release key
is answered by the Caddyfile on learn.halkyon.eu alone: the one domain the
project's builds name, and the server knows no app's key. A root test
holds its fingerprint to tool/release/android-certificate.sha256. The
app's intent filter comes with the sign-in; iOS's association waits for
an Apple team ID.

The profile page's language choice and look move to common/web_page.dart,
shared by both pages.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-23 15:27:56 +02:00
commit 8d6785f5c6
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 582 additions and 47 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apps/learn/halkyon_learn_server/config/production.yaml
View file

@ -15,9 +15,10 @@ apiServer:
# port through an SSH tunnel, never through Caddy.
# The web server serves profile pages (ADR 0011), the dictionaries devices
# download (ADR 0012) and the calls between the instance's services (ADR 0016).
# Caddy forwards the paths of the first two alone to it (deploy/Caddyfile),
# never the third; everything else stays on the API server.
# download (ADR 0012), SimpleLogin's forwarding page (ADR 0020) and the calls
# between the instance's services (ADR 0016). Caddy forwards the paths of the
# first three alone to it (deploy/Caddyfile), never the last; everything else
# stays on the API server.
webServer:
port: 8082
publicHost: learn.halkyon.eu