* Add mobile SSO support to sessions controller
Add /auth/mobile/:provider route and mobile_sso_start action that
captures device params in session and renders an auto-submitting POST
form to OmniAuth (required by omniauth-rails_csrf_protection).
Modify openid_connect callback to detect mobile_sso session, issue
Doorkeeper tokens via MobileDevice, and redirect to sureapp://oauth/callback
with tokens. Handles MFA users and unlinked accounts with error redirects.
Validates provider name against configured SSO providers and device info
before proceeding.
* Add SSO auth flow to Flutter service and provider
Add buildSsoUrl() and handleSsoCallback() to AuthService for
constructing the mobile SSO URL and parsing tokens from the deep
link callback.
Add startSsoLogin() and handleSsoCallback() to AuthProvider for
launching browser-based SSO and processing the redirect.
* Register deep link listener for SSO callback
Listen for sureapp://oauth/* deep links via app_links package,
handling both cold start (getInitialLink) and warm (uriLinkStream)
scenarios. Routes callbacks to AuthProvider.handleSsoCallback().
* Add Google Sign-In button to Flutter login screen
Add "or" divider and outlined Google Sign-In button that triggers
browser-based SSO via startSsoLogin('google_oauth2').
Add app_links and url_launcher dependencies to pubspec.yaml.
* Fix mobile SSO failure handling to redirect back to app
When OmniAuth fails during mobile SSO flow, redirect to
sureapp://oauth/callback with the error instead of the web login page.
Cleans up mobile_sso session data on failure.
* Address PR review feedback for mobile SSO flow
- Use strong params for device info in mobile_sso_start
- Guard against nil session data in handle_mobile_sso_callback
- Add error handling for AppLinks initialization and stream
- Handle launchUrl false return value in SSO login
- Use user-friendly error messages instead of exposing exceptions
- Reject empty token strings in SSO callback validation
* Consolidate mobile device token logic into MobileDevice model
Extract duplicated device upsert and token issuance code from
AuthController and SessionsController into MobileDevice. Add
CALLBACK_URL constant and URL builder helpers to eliminate repeated
deep-link strings. Add mobile SSO integration tests covering the
full flow, MFA rejection, unlinked accounts, and failure handling.
* Fix CI: resolve Brakeman redirect warnings and rubocop empty line
Move mobile SSO redirect into a private controller method with an
inline string literal so Brakeman can statically verify the target.
Remove unused URL builder helpers from MobileDevice. Fix extra empty
line at end of AuthController class body.
* Use authorization code exchange for mobile SSO and add signup error handling
Replace passing plaintext tokens in mobile SSO redirect URLs with a
one-time authorization code pattern. Tokens are now stored server-side
in Rails.cache (5min TTL) and exchanged via a secure POST to
/api/v1/auth/sso_exchange. Also wraps device/token creation in the
signup action with error handling and sanitizes device error messages.
* Add error handling for login device registration and blank SSO code guard
* Address PR #860 review: fix SSO race condition, add OpenAPI spec, and cleanup
- Fix race condition in sso_exchange by checking Rails.cache.delete return
value to ensure only one request can consume an authorization code
- Use strong parameters (params.require) for sso_exchange code param
- Move inline HTML from mobile_sso_start to a proper view template
- Clear stale session[:mobile_sso] flag on web login paths to prevent
abandoned mobile flows from hijacking subsequent web SSO logins
- Add OpenAPI/rswag spec for all auth API endpoints
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Fix mobile SSO test to match authorization code exchange pattern
The test was asserting tokens directly in the callback URL, but the code
uses an authorization code exchange pattern. Updated to exchange the code
via the sso_exchange API endpoint. Also swaps in a MemoryStore for this
test since the test environment uses null_store which discards writes.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Refactor mobile OAuth to use single shared application
Replace per-device Doorkeeper::Application creation with a shared
"Sure Mobile" OAuth app. Device tracking uses mobile_device_id on
access tokens instead of oauth_application_id on mobile_devices.
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Sure Mobile
A Flutter mobile application for Sure personal finance management system. This is the mobile client that connects to the Sure backend server.
About
This app is a mobile companion to the Sure personal finance management system. It provides basic functionality to:
- Login - Authenticate with your Sure Finance server
- View Balance - See all your accounts and their balances
For more detailed technical documentation, see docs/TECHNICAL_GUIDE.md.
Features
- 🔐 Secure authentication with OAuth 2.0
- 📱 Cross-platform support (Android & iOS)
- 💰 View all linked accounts
- 🎨 Material Design 3 with light/dark theme support
- 🔄 Token refresh for persistent sessions
- 🔒 Two-factor authentication (MFA) support
Requirements
- Flutter SDK >= 3.0.0
- Dart SDK >= 3.0.0
- Android SDK (for Android builds)
- Xcode (for iOS builds)
Getting Started
1. Install Flutter
Follow the official Flutter installation guide: https://docs.flutter.dev/get-started/install
2. Install Dependencies
flutter pub get
# For iOS development, also install CocoaPods dependencies
cd ios
pod install
cd ..
3. Generate App Icons
flutter pub run flutter_launcher_icons
This step generates the app icons for all platforms based on the source icon in assets/icon/app_icon.png. This is required before building the app locally.
4. Configure API Endpoint
Edit lib/services/api_config.dart to point to your Sure Finance server:
// For local development with Android emulator
static String _baseUrl = 'http://10.0.2.2:3000';
// For local development with iOS simulator
static String _baseUrl = 'http://localhost:3000';
// For production
static String _baseUrl = 'https://your-sure-server.com';
5. Run the App
# For Android
flutter run -d android
# For iOS
flutter run -d ios
# For web (development only)
flutter run -d chrome
Project Structure
.
├── lib/
│ ├── main.dart # App entry point
│ ├── models/ # Data models
│ │ ├── account.dart
│ │ ├── auth_tokens.dart
│ │ └── user.dart
│ ├── providers/ # State management
│ │ ├── auth_provider.dart
│ │ └── accounts_provider.dart
│ ├── screens/ # UI screens
│ │ ├── login_screen.dart
│ │ └── dashboard_screen.dart
│ ├── services/ # API services
│ │ ├── api_config.dart
│ │ ├── auth_service.dart
│ │ ├── accounts_service.dart
│ │ └── device_service.dart
│ └── widgets/ # Reusable widgets
│ └── account_card.dart
├── android/ # Android configuration
├── ios/ # iOS configuration
├── pubspec.yaml # Dependencies
└── README.md
API Integration
This app integrates with the Sure Finance Rails API:
Authentication
POST /api/v1/auth/login- User authenticationPOST /api/v1/auth/signup- User registrationPOST /api/v1/auth/refresh- Token refresh
Accounts
GET /api/v1/accounts- Fetch user accounts
Transactions
GET /api/v1/transactions- Get all transactions (optionally filter byaccount_idquery parameter)POST /api/v1/transactions- Create a new transactionPUT /api/v1/transactions/:id- Update an existing transactionDELETE /api/v1/transactions/:id- Delete a transaction
Transaction POST Request Format
{
"transaction": {
"account_id": "2980ffb0-f595-4572-be0e-7b9b9c53949b", // required
"name": "test", // required
"date": "2025-07-15", // required
"amount": 100, // optional, defaults to 0
"currency": "AUD", // optional, defaults to your profile currency
"nature": "expense" // optional, defaults to "expense", other option is "income"
}
}
CI/CD
The app includes automated CI/CD via GitHub Actions (.github/workflows/flutter-build.yml):
- Triggers: On push/PR to
mainbranch when Flutter files change - Android Build: Generates release APK and AAB artifacts
- iOS Build: Generates iOS release build (unsigned)
- Quality Checks: Code analysis and tests run before building
Downloading Build Artifacts
After a successful CI run, download artifacts from the GitHub Actions workflow:
app-release-apk- Android APK fileapp-release-aab- Android App Bundle (for Play Store)ios-build-unsigned- iOS app bundle (unsigned, see iOS build guide for signing)
Building for Release
Android
flutter build apk --release
# or for App Bundle
flutter build appbundle --release
iOS
# Ensure CocoaPods dependencies are installed first
cd ios && pod install && cd ..
# Build iOS release
flutter build ios --release
For detailed iOS build instructions, troubleshooting, and CI/CD setup, see docs/iOS_BUILD.md.
Future Expansion
This app provides a foundation for additional features:
- Transaction history
- Account sync
- Budget management
- Investment tracking
- AI chat assistant
- Push notifications
- Biometric authentication
License
This project is distributed under the AGPLv3 license.