[pwltr]

Part of synonymdev/bitkit-core#205
Twin: synonymdev/bitkit-ios#1332

This PR removes the legacy Pubky Ring sign-up path that also authorizes an app, so Bitkit no longer calls any bitkit-core Pubky auth export and bitkit-core can drop its legacy pubky module.

Description

• Removes approval of legacy sign-up links that authorize an app over the relay/secret/caps protocol (pubkyring://signup?hs&relay&secret&caps, and the same query under pubkyauth://signup), because Paykit only approves grant links and the next Pubky SDK drops legacy cookie auth.
• Rejects those links as invalid when they are scanned, pasted or opened in Bitkit, so the user sees the existing "This Pubky authorization link is invalid." error before consent and no identity is created.
• Stops registering Bitkit for pubkyring://signup links, so Android hands them to Pubky Ring, which still supports them.
• Keeps plain sign-up (pubkyauth://direct_signup and pubkyauth://signup with hs/st) and pubkyauth://signup_grant unchanged; both already go through Paykit.
• Removes the Ring relay timeout error, which only that path could raise; the timeout message string stays because contact deep links still use it.

Out of Scope

• pubkyauth://direct_signup with stray relay, secret or caps parameters: still accepted as a plain sign-up with those parameters ignored, as before.
• bitkit-core: removing approvePubkyAuth, parsePubkyAuthUrl, PubkyAuthDetails and the rest of the pubky module happens in chore: remove the pubky module bitkit-core#217; this PR builds against the currently pinned bitkit-core.
• iOS: the matching removal is chore: drop legacy Pubky Ring sign-up path bitkit-ios#1332.

Design

N/A — no UI changes.

Preview

N/A — no new UI; a legacy link shows the existing invalid-link error toast.

QA Notes

Setup

• Dev build (just run) from this branch on an emulator, with a wallet created and Paykit enabled, and no Pubky identity yet (fresh wallet or wiped profile).
• For case 3, install Pubky Ring on the same device; for case 4, uninstall it.
• Cases 1–4 need no homeserver or relay: the links are rejected before any network call. Case 5 needs a reachable homeserver from a Pubky Ring or staging setup that accepts the signup token used.

Journeys

N/A — no journey added or updated. The legacy-link rejection could be driven through the deep-link capability, but by maintainer decision it is covered by the reviewer cases below instead.

Manual Tests

• 1. Deliver pubkyauth://signup?hs=<homeserver>&relay=https%3A%2F%2Frelay.example&secret=x&caps=%2Fpub%2Fexample%2F%3Arw with adb shell am start -a android.intent.action.VIEW -d "<uri>" to.bitkit.dev → Bitkit shows "Authorization failed / This Pubky authorization link is invalid.", no consent screen, and no Pubky identity is created
• 2. Paste pubkyring://signup?hs=<homeserver>&relay=https%3A%2F%2Frelay.example&secret=x&caps=%2Fpub%2Fexample%2F%3Arw in the wallet scanner (Scan → Paste) → the same invalid-link error, and no identity is created
• 3. With Pubky Ring installed, deliver the pubkyring://signup?... link from case 2 via adb shell am start -a android.intent.action.VIEW -d "<uri>" (no package) → it opens in Pubky Ring; Bitkit is not offered
• 4. Without Pubky Ring installed, deliver the same pubkyring://signup?... link via adb → Bitkit is not offered and does not open
• 5. Deliver pubkyauth://direct_signup?hs=<homeserver>&st=<token> → the consent sheet shows the homeserver; approve → the identity is created and profile setup opens (plain sign-up still works)

Automated Checks

• added PubkyAuthRequestTest.kt — legacy Ring and pubkyauth://signup links with relay/secret/caps are rejected as invalid
• added PubkyRepoTest.kt — parsing a legacy Ring sign-up link fails as invalid without contacting Pubky
• updated PubkyRepoTest.kt — sign-up rollback and registration-failure cases use plain sign-up; grant sign-up still authorizes through Paykit before activation
• updated PubkyAuthManifestTest.kt — pubkyring://signup links no longer resolve to Bitkit
• updated PubkyAuthApprovalViewModelTest.kt — sign-up consent covers plain and grant sign-up only
• updated PubkyAuthApprovalRetryTest.kt — a failed sign-up restores consent and requires local auth on retry
• updated PubkyAuthErrorMessageTest.kt — unmapped and known errors without the removed Ring timeout error
• removed PubkyServiceTest.kt — relay-timeout and cancellation tests for the removed Ring approval
• ran just compile, just test, just lint — all passed

Evidence

• just compile, just test (5893 tests, 0 failures; 2 skipped live-regtest Spark tests from master) and just lint (detekt and Android Lint) passed locally on the branch head merged with origin/master 0a6734c49.

Gaps

• Manual cases 1–5 have not been run on a device; behaviour is covered by unit and Robolectric manifest tests only.
• Grant sign-up was not exercised end to end; it needs a controlled requesting app, homeserver and relay (see the pubky-auth journey README).

Models used

• Planning/scoping: claude-opus-5-5 (reasoning: high)
• Implementation: claude-opus-5-5 (reasoning: high)
• Review: Not performed

🤖 Generated with Claude Code

[github-actions]

Regtest APK

Built from 1ebcf4b (run).

Download bitkit-dev-debug universal APK (expires in 30 days).