feat: support Pubky signup

app/src/main/AndroidManifest.xml

@@ -163,7 +163,7 @@
                 android:resource="@xml/shortcuts" />
         </activity>
 
-        <!-- Enabled only while Bitkit can authorize pubkyauth requests locally. -->
+        <!-- Enabled only while Bitkit can authorize with a locally managed Pubky identity. -->
         <activity-alias
             android:name=".ui.MainActivityPubkyAuth"
             android:targetActivity=".ui.MainActivity"
@@ -174,6 +174,32 @@
                 <category android:name="android.intent.category.DEFAULT" />
                 <category android:name="android.intent.category.BROWSABLE" />
                 <data android:scheme="pubkyauth" />
+                <data android:host="signin_grant" />
+                <data android:host="signup_grant" />
+            </intent-filter>
+        </activity-alias>
+
+        <!-- Enabled only while Bitkit can create a Pubky identity. -->
+        <activity-alias
+            android:name=".ui.MainActivityPubkySignup"
+            android:targetActivity=".ui.MainActivity"
+            android:enabled="false"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="pubkyauth" />
+                <data android:host="signup" />
+                <data android:host="direct_signup" />
+            </intent-filter>
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data
+                    android:scheme="pubkyring"
+                    android:host="signup" />
             </intent-filter>
         </activity-alias>
 

app/src/main/java/to/bitkit/data/SettingsStore.kt

@@ -40,6 +40,9 @@ class SettingsStore @Inject constructor(
 
     val data: Flow<SettingsData> = store.data
     val isPaykitEnabled: Flow<Boolean> = localStore.data.map { it[PAYKIT_ENABLED_KEY] ?: false }
+    val isPubkyProfileSetupPending: Flow<Boolean> = localStore.data.map {
+        it[PUBKY_PROFILE_SETUP_PENDING_KEY] ?: false
+    }
 
     @Volatile
     var restoredMonitoredTypesFromBackup: Boolean = false
@@ -68,6 +71,10 @@ class SettingsStore @Inject constructor(
         localStore.edit { it[PAYKIT_ENABLED_KEY] = value }
     }
 
+    suspend fun setPubkyProfileSetupPending(value: Boolean) {
+        localStore.edit { it[PUBKY_PROFILE_SETUP_PENDING_KEY] = value }
+    }
+
     suspend fun addLastUsedTag(newTag: String) {
         store.updateData { currentSettings ->
             val combinedTags = (listOf(newTag) + currentSettings.lastUsedTags).distinct()
@@ -100,6 +107,7 @@ class SettingsStore @Inject constructor(
         private const val TAG = "SettingsStore"
         private const val MAX_LAST_USED_TAGS = 10
         private val PAYKIT_ENABLED_KEY = booleanPreferencesKey("paykit_enabled")
+        private val PUBKY_PROFILE_SETUP_PENDING_KEY = booleanPreferencesKey("pubky_profile_setup_pending")
     }
 }
 

app/src/main/java/to/bitkit/models/PubkyAuthRequest.kt

@@ -4,6 +4,7 @@ import androidx.compose.runtime.Immutable
 import to.bitkit.utils.AppError
 import java.net.URI
 import java.net.URLDecoder
+import java.net.URLEncoder
 import java.nio.charset.StandardCharsets
 
 enum class PubkyAuthClaim(val wireValue: String) {
@@ -71,13 +72,23 @@ data class PubkyAuthRequest(
     val permissions: List<PubkyAuthPermission>,
     val serviceNames: List<String>,
     val bitkitClaim: PubkyAuthClaim?,
+    val homeserverPublicKey: String? = null,
+    val signupToken: String? = null,
+    val authorizationUrl: String? = rawUrl,
 ) {
+    val isSignup: Boolean
+        get() = isSignupUrl(rawUrl)
+
     companion object {
+        @Suppress("LongParameterList")
         fun parse(
             rawUrl: String,
             clientId: String,
             relay: String,
             capabilities: String,
+            homeserverPublicKey: String? = null,
+            signupToken: String? = null,
+            authorizationUrl: String? = rawUrl,
         ): Result<PubkyAuthRequest> = parseBitkitClaim(rawUrl, capabilities).map { bitkitClaim ->
             val permissions = parseCapabilities(capabilities)
             PubkyAuthRequest(
@@ -88,9 +99,73 @@ data class PubkyAuthRequest(
                 permissions = permissions,
                 serviceNames = permissions.mapNotNull { extractServiceName(it.path) }.distinct(),
                 bitkitClaim = bitkitClaim,
+                homeserverPublicKey = homeserverPublicKey,
+                signupToken = signupToken,
+                authorizationUrl = authorizationUrl,
             )
         }
 
+        fun isProtocolUrl(rawUrl: String): Boolean = runCatching {
+            val uri = URI(rawUrl)
+            when (uri.scheme?.lowercase()) {
+                "pubkyauth" -> true
+                "pubkyring" -> uri.host.equals("signup", ignoreCase = true)
+                else -> false
+            }
+        }.getOrDefault(false)
+
+        fun isSignupUrl(rawUrl: String): Boolean = runCatching { URI(rawUrl).isSignupRequest() }.getOrDefault(false)
+
+        fun parseSignup(rawUrl: String): Result<PubkyAuthRequest> = runCatching {
+            val uri = URI(rawUrl)
+            require(uri.isSignupRequest()) { "Unsupported Pubky signup URL" }
+            val query = parseQuery(uri)
+            val homeserver = query.requiredSingle("hs")
+            val authorizesApp = uri.authorizesApp(query)
+            val relay = if (authorizesApp) query.requiredSingle("relay") else ""
+            val secret = if (authorizesApp) query.requiredSingle("secret") else ""
+            val capabilities = if (authorizesApp) query.requiredSingle("caps") else ""
+            val authorizationUrl = if (authorizesApp) {
+                ringAuthorizationUrl(relay, secret, capabilities)
+            } else {
+                null
+            }
+
+            parse(
+                rawUrl = rawUrl,
+                clientId = "",
+                relay = relay,
+                capabilities = capabilities,
+                homeserverPublicKey = homeserver,
+                signupToken = query.optionalSingle("st"),
+                authorizationUrl = authorizationUrl,
+            ).getOrThrow().also {
+                require(it.bitkitClaim == null) { "Pubky signup does not support Bitkit companion claims" }
+            }
+        }.fold(
+            onSuccess = { Result.success(it) },
+            onFailure = { Result.failure(PubkyAuthRequestError.InvalidUrl(it)) },
+        )
+
+        private fun URI.isSignupRequest(): Boolean = when (scheme?.lowercase()) {
+            "pubkyring" -> host.equals("signup", ignoreCase = true)
+            "pubkyauth" -> isDirectSignupRequest()
+            else -> false
+        }
+
+        private fun URI.isDirectSignupRequest(): Boolean =
+            scheme.equals("pubkyauth", ignoreCase = true) && (host ?: rawAuthority).let {
+                it.equals("direct_signup", ignoreCase = true) || it.equals("signup", ignoreCase = true)
+            }
+
+        private fun URI.authorizesApp(query: Map<String, List<String>>): Boolean =
+            scheme.equals("pubkyring", ignoreCase = true) ||
+                (
+                    scheme.equals("pubkyauth", ignoreCase = true) &&
+                        (host ?: rawAuthority).equals("signup", ignoreCase = true) &&
+                        listOf("relay", "secret", "caps").any(query::containsKey)
+                    )
+
         fun parseBitkitClaim(rawUrl: String, capabilities: String): Result<PubkyAuthClaim?> =
             parseBitkitClaimValues(rawUrl).fold(
                 onSuccess = { claimValues -> validateBitkitClaim(claimValues, capabilities) },
@@ -152,5 +227,31 @@ data class PubkyAuthRequest(
         }
 
         private fun decodeQueryComponent(value: String) = URLDecoder.decode(value, StandardCharsets.UTF_8.name())
+
+        private fun ringAuthorizationUrl(relay: String, secret: String, capabilities: String): String =
+            "pubkyauth:///?relay=${encodeQueryComponent(relay)}" +
+                "&secret=${encodeQueryComponent(secret)}&caps=${encodeQueryComponent(capabilities)}"
+
+        private fun encodeQueryComponent(value: String) =
+            URLEncoder.encode(value, StandardCharsets.UTF_8.name()).replace("+", "%20")
+
+        private fun parseQuery(uri: URI): Map<String, List<String>> = uri.rawQuery.orEmpty()
+            .split("&")
+            .filter { it.isNotEmpty() }
+            .map { it.split("=", limit = 2) }
+            .groupBy(
+                keySelector = { decodeQueryComponent(it.first()) },
+                valueTransform = { decodeQueryComponent(it.getOrElse(1) { "" }) },
+            )
+
+        private fun Map<String, List<String>>.requiredSingle(name: String): String =
+            optionalSingle(name)?.takeIf { it.isNotBlank() }
+                ?: throw IllegalArgumentException("Missing Pubky signup parameter: $name")
+
+        private fun Map<String, List<String>>.optionalSingle(name: String): String? {
+            val values = this[name].orEmpty()
+            require(values.size <= 1) { "Duplicate Pubky signup parameter: $name" }
+            return values.singleOrNull()?.takeIf { it.isNotBlank() }
+        }
     }
 }