TECHDEBT-Upgrade to oauth2

[chrisdebian]

Nick has done some brilliant work to get his unmaintained code working https://gitlab.com/nickw1/mapthepaths-android/-/commits/morow-investigation. A couple of things need to be updated, and one of these is oauth2.

Can anyone with the appropriate skills, help to implement oauth2; this would be a change from the deprecated oauth that is currently implemented.

Many thanks,

Chris.

[nickw1]

Have had a quick look for libraries to write an OAuth2 client in Android and have come up with this one from OpenID which looks promising:

https://github.com/openid/AppAuth-Android

I could almost certainly implement this, though I don't want to promise as it's dependent on my time availability.

[chrisdebian]

Hi, Nick.

All 'comers' are welcome. If you get a chance to give it a try, perfect! Don't think this is 'on you', though.

Thank you for anything you can manage.

Chris

[chrisdebian]

Nick,

If oath2 is implemented, in the future, would this automatically satisfy the OSM login requirement?

Just trying to avoid creating duplicate issues.

Thanks,

Chris

[nickw1]

Chris - yes it would. The OAuth protocol is used to login to OSM: third-party OSM logins now require oauth2, the old oauth1 protocol is no longer supported.

[nickw1]

@chrisdebian I've now got a working implementation of OAuth2 authentication to the OSM API. It's not within the current mapthepaths app, as I am rebuilding the interface using Jetpack Compose as I've already mentioned.

It's in the ofm-maplibre branch of my fork, in the morow-compose directory:

https://github.com/nickw1/MOROW/tree/ofm-maplibre/src/morow-compose

There's no edit or GPX upload functionality yet, but it will now be easy to update the code to use OAuth2. I'm thus wondering whether I should create a PR and we can close this issue now?

[chrisdebian]

Hi, Nick.

That would be brilliant! Any progress would be good, whilst I find time to 'get the show on the road'.

Happy New Year,

Chris

[nickw1]

Hello Chris, happy new year to you too. Will add a PR, as I said it's only a proof-of-concept now but it essentially means that the oauth2 login requirement has been implemented.

There are enhancements that can be done at a later date e.g. it's not recommended to ship an app with your secret as it can be obtained: but we can do that later once we're nearing production.