fix(oauth): resolve PR review issues and improve configuration
Critical Fixes (P0):
- Fix Constants.expoConfig fallback for native builds
* Add getConfig() helper that checks expoConfig, manifest2, manifestExtra, and process.env
* Prevents OAuth failures in EAS builds and production apps
* Throws descriptive errors if config is missing
Security & Best Practices:
- Remove all hardcoded fallback URLs to prevent accidental credential leakage
- Gate sensitive console.log statements with __DEV__ checks
- Add OAuth callback parameter validation (check for errors, required params)
- Validate domain consistency across iOS/Android configuration
Configuration Improvements:
- Simplify environment variables (4 vars → 1 required base URL)
- Create app.config.js for dynamic configuration
- Auto-extract OAuth server host for deep link configuration
- Fix iOS associatedDomains to match actual OAuth redirect domain
- Fix Android intentFilters to match actual OAuth redirect domain
- Use production-friendly custom scheme defaults (com.coves.app vs dev.workers...)
Developer Experience:
- Add automated config validation script (runs on npm start)
- Add OAuth pre-flight check script (npm run test-oauth)
- Move scripts to scripts/ folder following Expo conventions
- Create comprehensive documentation in docs/ folder
- Add .env.example template for team onboarding
- Update package.json with validation scripts
Package Updates:
- Update @atproto/api from 0.17.1 to 0.17.3
- Ensure all OAuth packages at latest versions
Breaking Changes:
- EXPO_PUBLIC_OAUTH_SERVER_URL now required (no fallback)
- Old env vars (EXPO_PUBLIC_OAUTH_CLIENT_ID, etc.) replaced by single base URL
- See .env.example for migration guide
Files Changed:
- lib/oauthClient.ts: Multi-source config lookup, removed fallbacks, gated logs
- app/oauth/callback.tsx: Config lookup, parameter validation, gated logs
- app.config.js: Dynamic host extraction, required config validation
- package.json: Added validation scripts, updated dependencies
- scripts/: Added validate-config.js and test-oauth.sh
- docs/: Added PROJECT_STRUCTURE.md
Fixes: All issues from PR review
Tested: npm run validate-config && npm run test-oauth
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>