Fix Android/TV Floatplane 403s via DPoP nonce handling (#52)

[kubo6472]

Summary

Investigated GitHub issue #52 (login failures + post-login Creators: 403, Subs: 403 / 429s on TV clients).

What changed on the Floatplane side

Probing auth.floatplane.com / www.floatplane.com shows:

1. Keycloak device/OAuth UI still serves the classic We are sorry... error page for client/config failures (matches the login symptom). Device-code start still works for client_id=floatnative; intermittent internal error during QR approval is on FP’s auth server, not something the app can fully fix.
2. DPoP is mandatory on the token endpoint (DPoP proof is missing without it). Invalid proofs can yield 500 unknown_error.
3. API 403 notLoggedInError is what Creators/Subscriptions return when DPoP/session auth fails — matching the Android error string in the issue.
4. Cloudflare bot mitigation now challenges some clients (cf-mitigated: challenge / Error 1010) for “bad” User-Agents (e.g. curl/*). App UAs still reach origin JSON from here, but aggressive 403→refresh loops can still produce 429 rate limits.

App bug that made this worse

iOS gained DPoP nonce capture/retry in Dec 2025 (use_dpop_nonce). Android never did. AuthInterceptor treated every 403 as “refresh the token,” which:

• fails nonce challenges (refresh doesn’t help)
• storms the token endpoint → 429s
• dropped User-Agent on retries

TV device login also skipped getSelf() cookie priming that the phone OAuth path does.

Fix

• Android: store/send DPoP-Nonce, retry use_dpop_nonce before refresh, keep User-Agent on retries, ignore Cloudflare HTML challenges for logout/refresh
• Android TV: completeDeviceLogin() primes sails.sid via /user/self then companion login
• iOS: retry token-endpoint use_dpop_nonce (like floatcli); prime user/cookie after device-flow success

Test plan

• Android TV: QR login → Home subscriptions load (no Failed to load subscriptions)
• Android TV: Creators tab loads (no Creators: 403, Subs: 403)
• Android phone: existing Custom-Tab OAuth login still works
• Apple TV: device login + feed load
• iPad: authorization-code login unchanged
• Confirm no refresh/logout loop when FP returns a nonce challenge

  

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b5387492-b716-4ae3-918c-c2c4a3114db0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch cursor/fp-auth-dpop-nonce-8633

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}