* Add Google SSO onboarding flow for Flutter mobile app Previously, mobile users attempting Google SSO without a linked OIDC identity received an error telling them to link from the web app first. This adds the same account linking/creation flow that exists on the PWA. Backend changes: - sessions_controller: Cache pending OIDC auth with a linking code and redirect back to the app instead of returning an error - api/v1/auth_controller: Add sso_link endpoint to link Google identity to an existing account via email/password, and sso_create_account endpoint to create a new SSO-only account (respects JIT config) - routes: Add POST auth/sso_link and auth/sso_create_account Flutter changes: - auth_service: Detect account_not_linked callback status, add ssoLink and ssoCreateAccount API methods - auth_provider: Track SSO onboarding state, expose linking/creation methods and cancelSsoOnboarding - sso_onboarding_screen: New screen with tabs to link existing account or create new account, pre-filled with Google profile data - main.dart: Show SsoOnboardingScreen when ssoOnboardingPending is true https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Fix broken SSO tests: use MemoryStore cache and correct redirect param - Sessions test: check `status` param instead of `error` since handle_mobile_sso_onboarding sends linking info with status key - API auth tests: swap null_store for MemoryStore so cache-based linking code validation works in test environment https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Delay linking-code consumption until SSO link/create succeeds Split validate_and_consume_linking_code into validate_linking_code (read-only) and consume_linking_code! (delete). The code is now only consumed after password verification (sso_link) or successful user save (sso_create_account), so recoverable errors no longer burn the one-time code and force a full Google SSO roundtrip. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Make linking-code consumption atomic to prevent race conditions Move consume_linking_code! (backed by Rails.cache.delete) to after recoverable checks (bad password, policy rejection) but before side-effecting operations (identity/user creation). Only the first caller to delete the cache key gets true, so concurrent requests with the same code cannot both succeed. - sso_link: consume after password auth, before OidcIdentity creation - sso_create_account: consume after allow_account_creation check, before User creation - Bad password still preserves the code for retry - Add single-use regression tests for both endpoints https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Add missing sso_create_account test coverage for blank code and validation failure - Test blank linking_code returns 400 (bad_request) with proper error - Test duplicate email triggers user.save failure → 422 with validation errors https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Verify cache payload in mobile SSO onboarding test with MemoryStore The test environment uses :null_store which silently discards cache writes, so handle_mobile_sso_onboarding's Rails.cache.write was never verified. Swap in a MemoryStore for this test and assert the full cached payload (provider, uid, email, name, device_info, allow_account_creation) at the linking_code key from the redirect URL. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Add rswag/OpenAPI specs for sso_link and sso_create_account endpoints POST /api/v1/auth/sso_link: documents linking_code + email/password params, 200 (tokens), 400 (missing code), 401 (invalid creds/expired). POST /api/v1/auth/sso_create_account: documents linking_code + optional first_name/last_name params, 200 (tokens), 400 (missing code), 401 (expired code), 403 (creation disabled), 422 (validation errors). Note: RAILS_ENV=test bundle exec rake rswag:specs:swaggerize should be run to regenerate docs/api/openapi.yaml once the runtime environment matches the Gemfile Ruby version. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Preserve OIDC issuer through mobile SSO onboarding flow handle_mobile_sso_onboarding now caches the issuer from auth.extra.raw_info.iss so it survives the linking-code round trip. build_omniauth_hash populates extra.raw_info.iss from the cached issuer so OidcIdentity.create_from_omniauth stores it correctly. Previously the issuer was always nil for mobile SSO-created identities because build_omniauth_hash passed an empty raw_info OpenStruct. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Block MFA users from bypassing second factor via sso_link sso_link authenticated with email/password but never checked user.otp_required?, allowing MFA users to obtain tokens without a second factor. The mobile SSO callback already rejects MFA users with "mfa_not_supported"; apply the same guard in sso_link before consuming the linking code or creating an identity. Returns 401 with mfa_required: true, consistent with the login action's MFA response shape. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Fix NoMethodError in SSO link MFA test Replace non-existent User.generate_otp_secret class method with ROTP::Base32.random(32), matching the pattern used in User#setup_mfa!. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c * Assert linking code survives rejected SSO create account Add cache persistence assertion to "should reject SSO create account when not allowed" test, verifying the linking code is not consumed on the 403 path. This mirrors the pattern used in the invalid-password sso_link test. The other rejection tests (expired/missing linking code) don't have a valid cached code to check, so no assertion is needed there. https://claude.ai/code/session_011ag1qSfriUg6j7TqFgbS5c --------- Co-authored-by: Claude <noreply@anthropic.com>
Sure Mobile
A Flutter mobile application for Sure personal finance management system. This is the mobile client that connects to the Sure backend server.
About
This app is a mobile companion to the Sure personal finance management system. It provides basic functionality to:
- Login - Authenticate with your Sure Finances server
- View Balance - See all your accounts and their balances
For more detailed technical documentation, see docs/TECHNICAL_GUIDE.md.
Features
- 🔐 Secure authentication with OAuth 2.0
- 📱 Cross-platform support (Android & iOS)
- 💰 View all linked accounts
- 🎨 Material Design 3 with light/dark theme support
- 🔄 Token refresh for persistent sessions
- 🔒 Two-factor authentication (MFA) support
Requirements
- Flutter SDK >= 3.0.0
- Dart SDK >= 3.0.0
- Android SDK (for Android builds)
- Xcode (for iOS builds)
Getting Started
1. Install Flutter
Follow the official Flutter installation guide: https://docs.flutter.dev/get-started/install
2. Install Dependencies
flutter pub get
# For iOS development, also install CocoaPods dependencies
cd ios
pod install
cd ..
3. Generate App Icons
flutter pub run flutter_launcher_icons
This step generates the app icons for all platforms based on the source icon in assets/icon/app_icon.png. This is required before building the app locally.
4. Configure API Endpoint
Edit lib/services/api_config.dart to point to your Sure Finances server:
// For local development with Android emulator
static String _baseUrl = 'http://10.0.2.2:3000';
// For local development with iOS simulator
static String _baseUrl = 'http://localhost:3000';
// For production
static String _baseUrl = 'https://your-sure-server.com';
5. Run the App
# For Android
flutter run -d android
# For iOS
flutter run -d <simulator-device-UDID>
# or
flutter run -d "iPhone 17 Pro"
# For web (development only)
flutter run -d chrome
Project Structure
.
├── lib/
│ ├── main.dart # App entry point
│ ├── models/ # Data models
│ │ ├── account.dart
│ │ ├── auth_tokens.dart
│ │ └── user.dart
│ ├── providers/ # State management
│ │ ├── auth_provider.dart
│ │ └── accounts_provider.dart
│ ├── screens/ # UI screens
│ │ ├── login_screen.dart
│ │ └── dashboard_screen.dart
│ ├── services/ # API services
│ │ ├── api_config.dart
│ │ ├── auth_service.dart
│ │ ├── accounts_service.dart
│ │ └── device_service.dart
│ └── widgets/ # Reusable widgets
│ └── account_card.dart
├── android/ # Android configuration
├── ios/ # iOS configuration
├── pubspec.yaml # Dependencies
└── README.md
API Integration
This app integrates with the Sure Finances Rails API:
Authentication
POST /api/v1/auth/login- User authenticationPOST /api/v1/auth/signup- User registrationPOST /api/v1/auth/refresh- Token refresh
Accounts
GET /api/v1/accounts- Fetch user accounts
Transactions
GET /api/v1/transactions- Get all transactions (optionally filter byaccount_idquery parameter)POST /api/v1/transactions- Create a new transactionPUT /api/v1/transactions/:id- Update an existing transactionDELETE /api/v1/transactions/:id- Delete a transaction
Transaction POST Request Format
{
"transaction": {
"account_id": "2980ffb0-f595-4572-be0e-7b9b9c53949b", // required
"name": "test", // required
"date": "2025-07-15", // required
"amount": 100, // optional, defaults to 0
"currency": "AUD", // optional, defaults to your profile currency
"nature": "expense" // optional, defaults to "expense", other option is "income"
}
}
CI/CD
The app includes automated CI/CD via GitHub Actions (.github/workflows/flutter-build.yml):
- Triggers: On push/PR to
mainbranch when Flutter files change - Android Build: Generates release APK and AAB artifacts
- iOS Build: Generates iOS release build (unsigned)
- Quality Checks: Code analysis and tests run before building
- TestFlight:
mobile-release(mobile tags) triggers.github/workflows/ios-testflight.ymlfor signed App Store Connect uploads as part of one release flow
See mobile/docs/iOS_TESTFLIGHT.md for required secrets and setup.
Downloading Build Artifacts
After a successful CI run, download artifacts from the GitHub Actions workflow:
app-release-apk- Android APK fileapp-release-aab- Android App Bundle (for Play Store)ios-build-unsigned- iOS app bundle (unsigned, see iOS build guide for signing)
Building for Release
Android
flutter build apk --release
# or for App Bundle
flutter build appbundle --release
iOS
# Ensure CocoaPods dependencies are installed first
cd ios && pod install && cd ..
# Build iOS release
flutter build ios --release
For detailed iOS build instructions, troubleshooting, and CI/CD setup, see docs/iOS_BUILD.md.
Future Expansion
This app provides a foundation for additional features:
- Transaction history
- Account sync
- Budget management
- Investment tracking
- AI chat assistant
- Push notifications
- Biometric authentication
License
This project is distributed under the AGPLv3 license.