Skip to content

Serve /.well-known app-association files for mobile deep links#142

Open
mikedegeofroy wants to merge 1 commit into
mainfrom
feat/app-links-well-known
Open

Serve /.well-known app-association files for mobile deep links#142
mikedegeofroy wants to merge 1 commit into
mainfrom
feat/app-links-well-known

Conversation

@mikedegeofroy

Copy link
Copy Markdown
Contributor

Server half of onno-erp/onno-mobile#5 — lets the onec-mobile app open directly from a server's https:// links (iOS Universal Links / Android App Links).

onec-ui-starter now serves the two association files the OS fetches:

Endpoint For
GET /.well-known/apple-app-site-association iOS Universal Links
GET /.well-known/assetlinks.json Android App Links

Design

  • WellKnownController + AppLinksProperties (@ConfigurationProperties("onec.app-links")), wired as @Beans in UiAutoConfiguration.
  • Public, unauthenticated, application/json, no redirect — the OS rejects the association on any login wall or redirect. They sit outside /api/** (public by default) and, being explicit controller mappings, take precedence over the SPA's /** index.html fallback.
  • 404 until configured, so an unconfigured deployment advertises no broken/empty association. Values are deployment-specific (Apple Team ID, bundle id / package, signing-cert SHA-256):
onec:
  app-links:
    apple-app-ids: ["<TeamID>.su.onno.onec.mobile"]
    android:
      - package-name: su.onno.onec.mobile
        sha256-cert-fingerprints: ["AB:CD:EF:..."]

Verification

  • Unit tests (WellKnownControllerTest, 4) — payload shape + 404-when-unconfigured.
  • Live against the example app: both endpoints 200 application/json; auth-exempt (a protected /api/** returns 401 while the AASA returns 200 with no cookies); no redirect; unknown paths still serve the SPA, so it isn't shadowed.

Docs

Updated docs/ARCHITECTURE.md (endpoint table + public-paths note), docs/CONFIGURATION.md, onec-ui-starter/README.md, and a commented block in the example app's application.yaml.

onec-ui-starter now serves apple-app-site-association and assetlinks.json so
iOS/Android open the onec-mobile app from a server's https:// links (Universal
Links / App Links).

- WellKnownController + AppLinksProperties (prefix onec.app-links), wired in
  UiAutoConfiguration. Public, unauthenticated, application/json, no redirect;
  both 404 until configured so an unconfigured server advertises no association.
- Docs (ARCHITECTURE endpoint table, CONFIGURATION, ui-starter README) and a
  commented example in the example app.

Server half of onno-erp/onno-mobile#5.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@mikedegeofroy mikedegeofroy force-pushed the feat/app-links-well-known branch from 931e057 to bb737a9 Compare June 17, 2026 04:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant