# Authentik OAuth Configuration for Alfred Mobile

## Issue
OAuth login fails with "Authorization failed: Unknown error" because the mobile redirect URI is not configured in Authentik.

## Solution

### Step 1: Access Authentik Admin
1. Go to https://auth.dnspegasus.net/if/admin/
2. Log in with admin credentials

### Step 2: Update OAuth Provider
1. Navigate to **Applications** → **Providers**
2. Find the provider with Client ID: `QeSNaZPqZUz5pPClZMA2bakSsddkStiEhqbE4QZR`
3. Click to edit

### Step 3: Add Mobile Redirect URI
In the **Redirect URIs** field, add:
```
alfredmobile://oauth/callback
```

**Important:** Keep the existing redirect URIs! You should have:
- `https://alfred.dnspegasus.net/oauth/callback` (web Control UI)
- `https://alfred-app.dnspegasus.net/oauth/callback` (proxy)
- `alfredmobile://oauth/callback` (mobile app) ← **ADD THIS**

### Step 4: Verify Configuration

After saving, the provider should have:
- **Client ID:** `QeSNaZPqZUz5pPClZMA2bakSsddkStiEhqbE4QZR`
- **Client type:** Confidential (or Public if using PKCE)
- **Redirect URIs:** All three URIs listed above
- **Scopes:** `openid profile email`

### Step 5: Test
1. Open Alfred Mobile on tablet
2. Tap "Sign In with Authentik"
3. Log in with Authentik credentials
4. Browser should redirect back to the app
5. App should show "Login successful!" toast and "Logged In!" screen

## Troubleshooting

### Still getting "Unknown error"?
- Check browser address bar when redirecting - does it show `alfredmobile://...`?
- Verify redirect URI matches exactly (no trailing slash, correct scheme)
- Check Authentik logs for rejected redirect attempts

### Browser doesn't redirect back?
- Android may ask "Open with Alfred?" - tap Yes
- If app doesn't open, check AndroidManifest.xml has the intent-filter

### "Invalid redirect URI" error?
- The redirect URI in Authentik doesn't match
- Make sure it's exactly: `alfredmobile://oauth/callback` (lowercase, no spaces)

## Alternative: Create Separate Mobile Provider (Optional)

If you want separate OAuth clients for web vs mobile:

1. Create a new OAuth2/OpenID Provider
2. Name it "Alfred Mobile"
3. Set Client ID to a new value (or keep the same)
4. Set Redirect URI to `alfredmobile://oauth/callback` only
5. Update `secrets.properties` with the new Client ID
6. Rebuild the app

This keeps mobile and web OAuth flows isolated.

---

**Current Config (shared provider):**
- Client ID: `QeSNaZPqZUz5pPClZMA2bakSsddkStiEhqbE4QZR`
- Used by: Web Control UI, OAuth proxy, Mobile app
- Redirect URIs: All three endpoints
