From 80bf9dd3141f3d87aac37f979a22bff308f7227c Mon Sep 17 00:00:00 2001
From: PianoNic <79938743+PianoNic@users.noreply.github.com>
Date: Sun, 19 Jul 2026 22:39:28 +0200
Subject: [PATCH] Allowed insecure OIDC connections for http backends

---
 lib/config/oidc_config.dart    | 5 +++++
 lib/services/auth_service.dart | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/lib/config/oidc_config.dart b/lib/config/oidc_config.dart
index 8a8e531..8c21291 100644
--- a/lib/config/oidc_config.dart
+++ b/lib/config/oidc_config.dart
@@ -34,6 +34,11 @@ class OidcSettings {
   /// Deep-link scheme the provider redirects back to (e.g. `schulytest`),
   /// derived from [redirectUri] so the app never hardcodes it.
   String get callbackScheme => Uri.parse(redirectUri).scheme;
+
+  /// Whether the OIDC endpoints use plaintext `http://` (a self-hosted / local
+  /// backend). flutter_appauth rejects http unless told to allow it, so this
+  /// gates `allowInsecureConnections`; https providers stay strict.
+  bool get allowInsecureConnections => Uri.parse(authorizationEndpoint).scheme == 'http' || Uri.parse(tokenEndpoint).scheme == 'http';
 }
 
 class OidcConfig {
diff --git a/lib/services/auth_service.dart b/lib/services/auth_service.dart
index f8c5058..1db9996 100644
--- a/lib/services/auth_service.dart
+++ b/lib/services/auth_service.dart
@@ -85,6 +85,7 @@ class AuthService {
         serviceConfiguration: _serviceConfig(cfg),
         scopes: cfg.scopes,
         promptValues: register ? const ['create'] : null,
+        allowInsecureConnections: cfg.allowInsecureConnections,
       ),
     );
     return _persist(result);
@@ -146,6 +147,7 @@ class AuthService {
           serviceConfiguration: _serviceConfig(cfg),
           refreshToken: refreshToken,
           scopes: cfg.scopes,
+          allowInsecureConnections: cfg.allowInsecureConnections,
         ),
       );
       final tokens = await _persist(result);
@@ -187,6 +189,7 @@ class AuthService {
             idTokenHint: idToken,
             postLogoutRedirectUrl: cfg.redirectUri,
             serviceConfiguration: _serviceConfig(cfg),
+            allowInsecureConnections: cfg.allowInsecureConnections,
           ),
         );
       }