[codex] Add Pubky Ring auth callbacks

[ben-kaufman]

Description

Fixes #913.

• Add Pubky Ring x-success, x-cancel, x-error, and x-source=Bitkit callback parameters before launching Ring auth.
• Handle bitkit://pubky-auth/success, bitkit://pubky-auth/cancel, and bitkit://pubky-auth/error deeplinks in the app.
• Keep relay-based completePubkyAuth() as the source of truth for successful session completion.
• Reset pending Ring auth UI on cancel/error callbacks and show the Ring error message when present.
• Add focused tests for callback URL generation and callback parsing.
• Clean existing import-order detekt findings so ./gradlew detekt reports no issues.

Preview

N/A, deeplink/auth flow change.

QA Notes

Validation run:

• git diff --check passed
• ./gradlew detekt passed with no findings
• ./gradlew compileDevDebugKotlin attempted, but blocked at :app:checkDevDebugAarMetadata because GitHub Packages credentials are missing (Username must not be null) for private Maven artifacts
• ./gradlew testDevDebugUnitTest attempted, but blocked for the same GitHub Packages credential issue

Suggested manual QA:

• Start Pubky Ring auth from Bitkit and approve in Ring; Bitkit should be reopened and continue the existing relay completion/import flow.
• Cancel in Ring; Bitkit should be reopened and the waiting/loading state should clear.
• Trigger a Ring error callback; Bitkit should be reopened, clear the pending auth state, and show an error toast.

[piotr-iohk]

Not sure if it is Bitkit or Ring, but going back to ring from Bitkit does not open the auth window correctly.
To reproduce:

• Import with Pubky Ring from Bitkit
• tap "Deny" in pubky-ring
• Import with Pubky Ring from Bitkit again
• see the Auth window does not appear (seems to be suppressed)

Below comparison with iOS (left), where the issue is not appearing:

Screen.Recording.2026-04-29.at.11.02.47.mov

[piotr-iohk]

Also see that x-error message in tooltip is presented for very short time. Could be presented a bit longer I think.

Screen.Recording.2026-04-30.at.14.29.39.mov

[ovitrif]

Why isn't it redirecting me back from Ring? 🤔

Am I missing something?

I added new Staging Pubky, because I thought that might be the issue, that I was using Prod identity from Ring, but then again, iOS counterpart PR worked that way too (synonymdev/bitkit-ios#537), and it still doesn't work anyways with staging.

PS. Asked Codex too.
PPS. Force-push was after rebase on master + drop change in CHANGELOG.md and replace it with manually adding similar changelog entry via changelog.d/next/917.added. No code Kotlin changes.

EDIT: NVM, I figured out the issue, I had to use new Pubky Ring build, thanks @coreyphillips 🙏🏻

[ovitrif]

LGTM

Tested:

• Approve
• Deny (cancel)
• Error (via temp patch in PubkyChoiceViewModel.startRingAuth() to send malformed pubkyauth URL to Ring.

[ovitrif]

actually, I did figure out with Codex that it doesn't match iOS here:

Android’s invalid nonce cancel/error handling does not match iOS. iOS ignores stale/mismatched callbacks; Android currently ends the active auth attempt for invalid cancel/error.

Probably misses your latest updates to the iOS counterpart PR that got merged?

[ovitrif]

Pushed fix: ignore stale pubky callbacks (b805610)

What changed:

• Android now matches iOS nonce validation for Pubky Ring callbacks.
• Success/cancel/error callbacks are only trusted when the callback nonce matches the active auth attempt.
• Missing, blank, or mismatched nonce callbacks are ignored, so stale Ring responses cannot abort a newer auth attempt.
• Android also normalizes a bare ?nonce callback param to missing, which keeps behavior aligned with iOS and fixes the unit-test failure.

Important for testing:

• To test approve/deny/error returning from Ring, use a Pubky Ring build from the latest nonce-fix branch/PR that preserves the callback nonce.
  • fix: preserve x-callback URL nonce pubky/pubky-ring#268
• Older/current Ring builds may return something like bitkit://pubky-auth/cancel?nonce on Deny. That is intentionally ignored by Bitkit now, so Bitkit will remain waiting in that case.

Suggested manual test:

1. Install the Android PR build.
2. Install a Pubky Ring build that includes the nonce preservation fix.
3. Start Pubky Ring auth from Bitkit.
4. Approve in Ring: Bitkit should return and complete auth.
5. Start auth again and Deny in Ring: Bitkit should return and clear the waiting state.
6. Start auth again and trigger an Error callback from Ring: Bitkit should return and show the trusted Ring error.

Stale callback check:

• While Bitkit is waiting on a real auth attempt, open bitkit://pubky-auth/cancel?nonce=invalid via adb.

adb shell am start -a android.intent.action.VIEW -d 'bitkit://pubky-auth/cancel?nonce=invalid' to.bitkit.dev

• Expected: Bitkit may foreground, but it should ignore the callback and keep the active auth attempt alive.

[ovitrif]

Will retest test later if I get a build from Corey, to validate against the latest changes for the nodes in Pubky Ring.

Otherwise, everything is already tested and looking good, so normally this pull request can be merged.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.