From 4a2eaf5b76ebce6d36359ab547b6e2085cf1260c Mon Sep 17 00:00:00 2001
From: Dylan Jeffers <dylan@audius.co>
Date: Wed, 17 Dec 2025 12:28:50 -0800
Subject: [PATCH] Prevent android app from handling oauth routes

---
 .../android/app/src/main/AndroidManifest.xml    | 14 ++++++++++++++
 .../src/main/java/co/audius/app/MainActivity.kt | 17 +++++++++++++----
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/packages/mobile/android/app/src/main/AndroidManifest.xml b/packages/mobile/android/app/src/main/AndroidManifest.xml
index 8c4a5c6741f..aa33b9895cc 100755
--- a/packages/mobile/android/app/src/main/AndroidManifest.xml
+++ b/packages/mobile/android/app/src/main/AndroidManifest.xml
@@ -54,6 +54,8 @@
                 <action android:name="android.intent.action.DOWNLOAD_COMPLETE" />
             </intent-filter>
 
+            <!-- Deeplink intent filter for audius.co and redirect.audius.co -->
+            <!-- Note: /oauth routes are black-listed via separate intent filter below -->
             <intent-filter android:autoVerify="true">
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
@@ -63,6 +65,18 @@
                 <data android:host="redirect.audius.co" />
                 <data android:host="audius.co" />
             </intent-filter>
+            <!-- Intent filter for oauth routes with autoVerify=false to black-list from App Links verification -->
+            <!-- These routes will still reach MainActivity which redirects them to browser -->
+            <intent-filter android:autoVerify="false">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="https" />
+                <data android:scheme="http" />
+                <data android:host="redirect.audius.co" />
+                <data android:host="audius.co" />
+                <data android:pathPrefix="/oauth" />
+            </intent-filter>
             <intent-filter android:autoVerify="true">
                 <action android:name="android.intent.action.VIEW" />
                 <category android:name="android.intent.category.DEFAULT" />
diff --git a/packages/mobile/android/app/src/main/java/co/audius/app/MainActivity.kt b/packages/mobile/android/app/src/main/java/co/audius/app/MainActivity.kt
index ed637339a7c..f25b351ef11 100644
--- a/packages/mobile/android/app/src/main/java/co/audius/app/MainActivity.kt
+++ b/packages/mobile/android/app/src/main/java/co/audius/app/MainActivity.kt
@@ -79,10 +79,19 @@ class MainActivity : ReactActivity() {
       val path = data.path
       // If the path starts with /oauth, open in browser instead
       if (path != null && path.startsWith("/oauth")) {
-        val browserIntent = Intent(Intent.ACTION_VIEW, data)
-        browserIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
-        startActivity(browserIntent)
-        return true
+        try {
+          val browserIntent = Intent(Intent.ACTION_VIEW, data)
+          browserIntent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP)
+          // Verify that an activity can handle this intent
+          if (browserIntent.resolveActivity(packageManager) != null) {
+            startActivity(browserIntent)
+            return true
+          }
+        } catch (e: Exception) {
+          // If opening browser fails, at least prevent the app from handling the deeplink
+          e.printStackTrace()
+          return true
+        }
       }
     }