From 18ce58e84aa233e8360922f89289cde314026aeb Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Tue, 23 Jun 2026 21:30:56 +0100
Subject: [PATCH] postit: drop 127.0.0.1:7890 loopback redirect from production
 defaults

The custom URI scheme (postit://callback) is now the only production
redirect on desktop. The loopback listener at 127.0.0.1:7890 is dead
since the previous scheme-handler refactor; this commit removes it
from every place that could pick it as a default.

Changes:
- Settings.RedirectUri now defaults to DefaultDesktopRedirectUri
  (postit://callback) instead of DefaultLoopbackRedirectUri.
- Settings.ApplyJson falls back to DefaultDesktopRedirectUri when
  the user settings file omits the RedirectUri field (was
  DefaultLoopbackRedirectUri before).
- postit-settings sample.json: RedirectUri flipped to postit://callback
  so anyone copying the sample gets a working config.
- DefaultLoopbackRedirectUri kept as a legacy constant (now
  documented as test-only); OidcStubAuthority / FakeAuthorizingBrowser
  continue to use it as a test fixture.
- The doc on RedirectUri now describes the custom-scheme path and
  references AndroidRedirectUri for mobile.

Reminder for the operator: also remove the matching
http://127.0.0.1:7890/ entry from the Yavsc.Org server's allowed
redirect URIs (see src/Yavsc.Org/Extensions/HostingExtensions.cs)
since no client uses it any more.

Tests: 21/21 still green. No code path now sends anything to port 7890
in production.
---
 src/PostIt/PostIt/Settings/Settings.cs        | 32 +++++++++++--------
 src/PostIt/PostIt/postit-settings sample.json |  2 +-
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/src/PostIt/PostIt/Settings/Settings.cs b/src/PostIt/PostIt/Settings/Settings.cs
index 22acffb5..d51c5ee5 100644
--- a/src/PostIt/PostIt/Settings/Settings.cs
+++ b/src/PostIt/PostIt/Settings/Settings.cs
@@ -21,11 +21,16 @@ public partial class Settings : ObservableObject
     IStorageFolder? folder = null;
 
     /// <summary>
-    /// Loopback redirect URI alternative. Used by the test harness and
-    /// available as a fallback if the running platform cannot register
-    /// the default custom-scheme handler (<c>postit://callback</c>).
-    /// Production builds prefer <see cref="Platform.DefaultRedirectUri"/>
-    /// which routes through the OS-registered URI scheme (RFC 8252).
+    /// Legacy loopback redirect URI. The post-2026.6 production flow
+    /// uses the custom URI scheme (<see cref="DefaultDesktopRedirectUri"/>
+    /// on desktop, <see cref="AndroidRedirectUri"/> on Android) so the
+    /// OS hands the callback to the running instance without a TCP
+    /// listener. The loopback constant stays here so test fixtures
+    /// (which spin up an in-process OidcStubAuthority) keep working,
+    /// but it is no longer used as a default anywhere in production.
+    /// If you are still pointing your production <c>postit-settings.json</c>
+    /// at this URI, switch to <c>postit://callback</c> and remove the
+    /// matching entry from the Yavsc.Org server's allowed redirect URIs.
     /// </summary>
     public const string DefaultLoopbackRedirectUri = "http://127.0.0.1:7890/";
 
@@ -37,9 +42,9 @@ public partial class Settings : ObservableObject
 
     /// <summary>
     /// Default custom-scheme redirect URI on Desktop. The OS routes the
-    /// callback to the running PostIt instance via the named-pipe hand-off
-    /// in <see cref="PostIt.Services.SingleInstance"/>. Production
-    /// Desktop builds use this; loopback HTTP is only a fallback.
+    /// callback to the running PostIt instance via the named-pipe
+    /// hand-off in <see cref="PostIt.Services.SingleInstance"/>
+    /// (RFC 8252 §7.1). Production Desktop builds use this.
     /// </summary>
     public const string DefaultDesktopRedirectUri = "postit://callback";
 
@@ -53,12 +58,13 @@ public partial class Settings : ObservableObject
     public partial string ApiUrl { get; set; } = "https://blogs.pschneider.fr/api/v1/";
 
     /// <summary>
-    /// OAuth redirect URI. Defaults to a loopback URI suitable for desktop
-    /// apps; mobile platforms must set this to <see cref="AndroidRedirectUri"/>
-    /// before calling <c>LoginAsync</c>.
+    /// OAuth redirect URI. Defaults to <see cref="DefaultDesktopRedirectUri"/>
+    /// (custom URI scheme) which is the right answer for desktop
+    /// production builds. Mobile platforms must set this to
+    /// <see cref="AndroidRedirectUri"/> before calling <c>LoginAsync</c>.
     /// </summary>
     [ObservableProperty]
-    public partial string RedirectUri { get; set; } = DefaultLoopbackRedirectUri;
+    public partial string RedirectUri { get; set; } = DefaultDesktopRedirectUri;
 
 
     [ObservableProperty]
@@ -168,7 +174,7 @@ public partial class Settings : ObservableObject
             this.Authentication = settings.Authentication;
             this.DarkMode = settings.DarkMode;
             this.ApiUrl = settings.ApiUrl;
-            this.RedirectUri = string.IsNullOrWhiteSpace(settings.RedirectUri) ? DefaultLoopbackRedirectUri : settings.RedirectUri;
+            this.RedirectUri = string.IsNullOrWhiteSpace(settings.RedirectUri) ? DefaultDesktopRedirectUri : settings.RedirectUri;
             this.Scopes = settings.Scopes;
         }
         catch (Exception ex)
diff --git a/src/PostIt/PostIt/postit-settings sample.json b/src/PostIt/PostIt/postit-settings sample.json
index 9cc9c38e..b435d8d5 100644
--- a/src/PostIt/PostIt/postit-settings sample.json	
+++ b/src/PostIt/PostIt/postit-settings sample.json	
@@ -3,7 +3,7 @@
         "ClientId": "postit",
         "Authority": "https://yavsc.pschneider.fr"
     },
-    "RedirectUri": "http://127.0.0.1:7890/",
+    "RedirectUri": "postit://callback",
     "DarkMode": false,
     "ApiUrl": "https://blogs.pschneider.fr/api/v1/",
     "Scopes": [