trails-cool/trails
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
trails/openspec/changes/mobile-app/specs/journal-auth/spec.md
Ullrich Schäfer fff77a2ed2
Add mobile app, map-core, nearby sync, and activity recording specs 
mobile-app: Unified React Native + Expo app combining Planner and
Journal. OAuth2 PKCE auth, MapLibre maps, versioned REST API with
Zod schemas, configurable server URL, offline SQLite, Web Push relay
notifications. TanStack Query + Zustand state management. Jest +
Maestro testing. 76 tasks across 5 phases.

map-core-package: Extract renderer-agnostic map definitions (tiles,
color palettes, POI categories, z-index) into @trails-cool/map-core.
Pure refactor preparing for MapLibre on mobile. 27 tasks.

mobile-activity-recording: GPS recording, live stats, HealthKit/Health
Connect export. Separated from mobile-app for independent scheduling.

mobile-nearby-sync: BLE route sync between nearby devices for offline
group riding. QR waypoint sharing as simpler v1. TXQR noted as future.

journal-rest-api spec: Full API contract — endpoints, auth, pagination,
errors, discovery, versioning, BRouter proxy.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-12 21:52:30 +02:00

1.5 KiB
Raw Blame History

MODIFIED Requirements

Requirement: OAuth2 PKCE authorization flow

The Journal SHALL support OAuth2 authorization code flow with PKCE for mobile app token exchange, in addition to existing passkey and magic link authentication.

Scenario: Authorization endpoint

  • WHEN a client requests GET /oauth/authorize with client_id, redirect_uri, code_challenge, and code_challenge_method
  • THEN the Journal shows the existing login UI and, upon successful authentication, redirects to the redirect_uri with an authorization code

Scenario: Token exchange

  • WHEN a client sends POST /oauth/token with the authorization code, code_verifier, client_id, and redirect_uri
  • THEN the Journal validates the PKCE challenge, issues an access token and refresh token, and returns them

Scenario: Token refresh

  • WHEN a client sends POST /oauth/token with grant_type=refresh_token and a valid refresh token
  • THEN the Journal issues a new access token and optionally a new refresh token

Scenario: Invalid PKCE challenge

  • WHEN a client sends a code_verifier that does not match the stored code_challenge
  • THEN the Journal rejects the token exchange with a 400 error

Requirement: OAuth2 client registration

The Journal SHALL register the mobile app as a trusted first-party OAuth2 client.

Scenario: Mobile app client

  • WHEN the mobile app initiates an OAuth2 flow with client_id trails-cool-mobile
  • THEN the Journal recognizes it as a trusted client and allows the trailscool:// redirect URI scheme