* feat(#350): pairing login flow with QR scan + manual entry
Adds PairingCodeEntryScreen with CameraX + ML Kit QR scanning
and manual code entry. The screen parses hermes://connect URIs,
Base64-encoded JSON, and raw token formats, validates via
/api/status, and saves credentials on success.
- New PairingCodeEntryScreen + PairingCodeEntryViewModel
- CameraX 1.4.1 + ML Kit barcode-scanning 17.3.0
- CAMERA permission + proguard rules
- Landing screen Pairing Login button wired correctly
* fix(#350): resolve smart-cast on delegated property for errorMessage
Co-authored-by: Hy4ri <hy4ri@users.noreply.github.com>
* refactor(#421): remove QR scanner from pairing login
- Remove CameraX + ML Kit barcode dependencies
- Drop CAMERA permission and camera feature from manifest
- Strip QrScannerTab, QrCodeScannerView, processFrame composables
- Remove camera permission state/methods from ViewModel
- Purge all QR/camera strings from strings.xml
- Delete ML Kit proguard rules
The pairing login now shows only the manual code entry UI.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* feat(#349): smart auth login flow — probe dashboard, show correct fields
Landing screen with two buttons (Auth Login / Pairing Login) replaces
ConnectScreen as the start screen. Auth login probes the dashboard to
detect what auth it needs (token-only, basic-auth, or both) and shows
only the relevant input fields.
Changes:
- NavigationKeys.kt: add LandingScreen, AuthLoginScreen NavKeys
- LandingScreen.kt: new screen with hero icon + two login buttons
- AuthLoginScreen.kt: IP/Port input, probe logic, dynamic field rendering
- AuthLoginViewModel.kt: probe API, dashboard auth detection, connect flow
- Navigation.kt: wire new screens, start on LandingScreen, hide bottom bar
- strings.xml: add string resources for both screens
* fix(#351): align AuthLoginScreen field names with ViewModel API, fix TAG refs
- state.isProbing → state.probing
- DashboardAuthMode.BOTH → DashboardAuthMode.ALL
- viewModel.probe() → viewModel.probeDashboard()
- state.isConnecting → state.isLoading
- Removed unused TAG constant, replaced with inline tag string
- Made connectTokenOnly suspend to fix safeApiCall compilation
This fixes the CI compilation errors.
* fix(#351): revert probeDashboard() call to probe() to match VM
* fix(#351): rename isProbing to probing in ViewModel
* fix(#351): follow redirects in basic auth login — / redirects to /login
* fix(#351): show all fields when basic auth detected — still needs session token for WS
* refactor(#349): remove old ConnectScreen, clean up NavKey + navigation
* fix(#351): validate token against /api/sessions (auth-protected) instead of /api/status (public)
/api/status is a public endpoint that returns 200 even with wrong tokens,
causing invalid tokens to be saved and the WebSocket to spin forever on
the chat screen. /api/sessions requires auth and returns 401 on bad tokens.
* fix(#351): rewrite basic auth login — POST to /auth/password-login, then fetch SPA with cookie to extract token
* fix(#351): use ticket-based WS auth when basic auth is active
The updated dashboard on 0.0.0.0 always has auth_required=True, which
rejects legacy ?token= in favor of ?ticket= (single-use, 30s TTL).
Added AuthManager.setWsAuthParam() to support both ?token= (loopback)
and ?ticket= (gated mode) in wsUrl(). connectBasicAuth now mints a
ticket via POST /api/auth/ws-ticket after login instead of extracting
the token from the SPA.
* fix(#351): use requirePrefs() instead of direct prefs reference in wsUrl()
* fix(#351): handle relaxed-mock empty string in wsUrl() authParam fallback
* feat(#349): auto-extract session token from SPA HTML during probe
The probe now extracts the __HERMES_SESSION_TOKEN__ value from the
dashboard SPA and auto-populates the token field in TOKEN_ONLY mode,
eliminating the need for manual token pasting.
- Introduced ProbeResult data class to carry authMode + extractedToken
- Regex extraction of __HERMES_SESSION_TOKEN__ from dashboard HTML
- Token field auto-filled on probe completion for TOKEN_ONLY mode
* fix(#349): return BASIC_AUTH from probe when basic auth detected
Bug: probe returned ALL instead of BASIC_AUTH for basic-auth-only
dashboards, causing token+credential fields to show and the connect
flow to fall through to connectTokenOnly() on basic auth failure,
producing a confusing 'Unauthorized (HTTP 401)' NetworkResult error.
Fix: probe now returns DashboardAuthMode.BASIC_AUTH when a redirect
to /login is detected. BASIC_AUTH in connect() calls
connectBasicAuth() directly with no fallback. ALL mode also no longer
falls through to connectTokenOnly().
* fix(#349): use session cookie for REST API in gated mode
The dashboard's gated mode authenticates REST API requests via
session cookies (hermes_session_at), not Bearer tokens. The app
was storing the WS ticket as the token and sending it as
Authorization: Bearer <ticket> for all REST calls, which the
server rejected with 401.
- Extract hermes_session_at cookie from Set-Cookie header after
POST /auth/password-login and store it in AuthManager
- ApiClient authInterceptor now sends Cookie header when session
cookie is present, falls back to Bearer token for loopback mode
- ConnectResult carries both WS credential (ticket) and session
cookie separately
- WS ticket used only for WebSocket (?ticket=), session cookie
used for REST API
* feat(#349): add logout button to Settings > About
Red error-style button that clears all auth credentials (token,
session cookie, WS auth param) and navigates back to LandingScreen.
Wired through SettingsScreen onLogout callback to Navigation.kt.
* fix(#349): improve logout navigation flow
* fix(#349): keep backstack stable across logout
Use remember without keys for NavBackStack so the same backstack
object persists across startScreen changes. Use LaunchedEffect keyed
on startScreen to reset stack content atomically. This avoids
NavDisplay losing snapshot observation when a new NavBackStack
object is created.
* fix(#349): mint fresh WS ticket on every connect
The WS ticket is a single-use 30-second credential. On app restart
(or reconnect), the stored ticket is expired. Now refreshWsTicketIfNeeded()
mints a new ticket using the session cookie before every WS connection
attempt. Loopback mode (no session cookie) is unaffected.
* fix(#349): refresh ticket in openSocket for reconnect paths
scheduleReconnect() bypasses connect() and calls openSocket()
directly. Moving the ticket refresh into openSocket() ensures
every WS connection attempt — first launch and reconnect —
uses a fresh ticket.
* fix(#349): stub getSessionCookie() in ApiClientTest
mockkObject(AuthManager) is strict, so unstubbed getSessionCookie()
calls throw MockKException which manifests as IOException.
---------
Co-authored-by: M57 <hy4ri@users.noreply.github.com>
* feat: move session history to a dedicated history screen
Closes#159.
* fix(ci): fix ktlint style issues and unresolved NavigationController reference
