Removed MainActivity taskAffinity so OIDC redirect returns to the app

android/app/build.gradle.kts

@@ -34,6 +34,9 @@ android {
         targetSdk = flutter.targetSdkVersion
         versionCode = flutter.versionCode
         versionName = flutter.versionName
+        // OIDC redirect scheme for flutter_appauth's RedirectUriReceiverActivity.
+        // Must match the backend's redirect URI scheme (schulytest://callback).
+        manifestPlaceholders["appAuthRedirectScheme"] = "schulytest"
     }
 
     flavorDimensions += "environment"

android/app/src/main/AndroidManifest.xml

@@ -12,7 +12,6 @@
             android:name=".MainActivity"
             android:exported="true"
             android:launchMode="singleTop"
-            android:taskAffinity=""
             android:theme="@style/LaunchTheme"
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
             android:hardwareAccelerated="true"
@@ -29,15 +28,10 @@
                 <action android:name="android.intent.action.MAIN"/>
                 <category android:name="android.intent.category.LAUNCHER"/>
             </intent-filter>
-            <!-- OIDC callback deep link: Pocket ID redirects to
-                 schulytest://callback?code=... after login; Android routes
-                 it back to this activity, app_links surfaces it. -->
-            <intent-filter android:autoVerify="false">
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="schulytest" />
-            </intent-filter>
+            <!-- The OIDC callback (schulytest://callback) is handled by
+                 flutter_appauth's own RedirectUriReceiverActivity, registered via
+                 the appAuthRedirectScheme manifestPlaceholder in build.gradle.kts.
+                 No manual intent-filter is needed here. -->
         </activity>
         <!-- Don't delete the meta-data below.
              This is used by the Flutter tool to generate GeneratedPluginRegistrant.java -->

ios/Runner/Info.plist

@@ -48,10 +48,10 @@
 	<key>UIApplicationSupportsIndirectInputEvents</key>
 	<true/>
 	<!-- OIDC (account mode) returns to the app via the backend's custom
-	     redirect scheme (schulytest://callback). Registering it here lets iOS
-	     route the login callback back into the app; without it the external
-	     browser fails with "cannot open the URL". The scheme matches the
-	     backend's redirectUri / OidcConfig fallback. -->
+	     redirect scheme (schulytest://callback), driven by flutter_appauth over
+	     ASWebAuthenticationSession. Registering it here lets iOS route the login
+	     callback back into the app. The scheme matches the backend's redirectUri
+	     / OidcConfig fallback. -->
 	<key>CFBundleURLTypes</key>
 	<array>
 		<dict>

lib/config/oidc_config.dart

@@ -16,6 +16,7 @@ class OidcSettings {
   final String redirectUri;
   final String authorizationEndpoint;
   final String tokenEndpoint;
+  final String? endSessionEndpoint;
 
   const OidcSettings({
     required this.authority,
@@ -24,8 +25,12 @@ class OidcSettings {
     required this.redirectUri,
     required this.authorizationEndpoint,
     required this.tokenEndpoint,
+    this.endSessionEndpoint,
   });
 
+  /// The OIDC scopes as a list, split from the space-delimited [scope] string.
+  List<String> get scopes => scope.split(' ').where((s) => s.isNotEmpty).toList();
+
   /// Deep-link scheme the provider redirects back to (e.g. `schulytest`),
   /// derived from [redirectUri] so the app never hardcodes it.
   String get callbackScheme => Uri.parse(redirectUri).scheme;
@@ -76,6 +81,7 @@ class OidcConfig {
       redirectUri: (app['redirectUri'] as String?) ?? 'schulytest://callback',
       authorizationEndpoint: disco['authorization_endpoint'] as String,
       tokenEndpoint: disco['token_endpoint'] as String,
+      endSessionEndpoint: disco['end_session_endpoint'] as String?,
     );
   }