# Feature SI-4 - Quick OAuth configuration flow for mobile app

Project: Stream Integration Basics
Status: on hold
URL: https://community.openproject.org/work_packages/SI-4

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | Product Backlog |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

| ID | Subject | Status | Decision |
| --- | --- | --- | --- |
| SI-9 | What is the redirect URI for the flutter app? | resolved | The redirect URI is openprojectapp://oauth-callback |

## Features and Chunks

| ID | Subject | Type | Status | Assignee | Target versions | Spent time |
| --- | --- | --- | --- | --- | --- | --- |
| SI-26 | Disable built-in OAuth application by default | Implementation | closed |  | 14.6.0 |  |
| SI-27 | Enforce PKCE for built-in application | Implementation | rejected |  |  |  |
| SI-28 | Remove tokens when application gets disabled | Implementation | new |  |  |  |
| SI-29 | Add PKCE info to application details | Implementation | new |  |  |  |

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups | https://www.figma.com/design/iIVdwEIL0MKQLn5MYX8AwZ/Authentication?node-id=1-8937&t=PzWibTEUoaFBU0Pq-0 |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable | Dominic Bräunlein |
| Product manager |  |
| Developers | OP Dev Titan Team |
| Designer | Marc Alcobé |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** an admin of an OpenProject installation  
**I want to** easily setup an OAuth app for mobile apps  
**so that** my users don‘t have to enter a client ID when setting up their mobile app.

**Acceptance criteria**

  - Seed OAuth application for the use of mobile apps
    
      - Seeding will also be run for existing installations
    
      - Register non-confidential app (that means there is no secret) with predefined Application ID: `openprojectmobileapp`
    
      - Allowed redirect URI: `openprojectmobileapp://oauth-callback`
    
      - OAuth Application name: OpenProject Mobile App

  - Mark the seeded OAuth application as builtin, preventing its deletion or editing

  - Allow enabling/disabling of the built-in OAuth application. ~~Other OAuth applications do not need~~

  - ~~Enforce PKCE (<https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md>). Don't allow changing that value.~~
    
      - Doorkeeper does not support enforcing PKCE per application -\> we cannot selectively enforce PKCE on some applications as mobile, only globally for all
    
      - Side Note: Doorkeeper does not support enforcing PKCE on confidential client requests 😤

  - OAuth applications are split into two lists: **Built-in OAuth applications** and **Other OAuth applications**

  - When clicking on the name of a OAuth Application the (read-only) details view opens.

  - OAuth table is a primer border box

  - All clickable elements inside the box have the link color (ref <mention class="mention" data-id="57649" data-type="work_package" data-text="#57649">#57649</mention>)

  - After disabling a OAuth application the access tokens should invalid immediately

**Implementation chunks left:**  
- <mention class="mention" data-id="58089" data-type="work_package" data-text="##58089">##58089</mention>   
- <mention class="mention" data-id="58096" data-type="work_package" data-text="##58096">##58096</mention>

**Out of scope:**

  - Primerization of **OAuth application** details page

### QA

  - the whole feature is currently behind the feature flag "Built in Oauth Applications", if not activated switch it on `/admin/settings/experimental`
    
      - If the feature flag is taken off before release, disregard that