Discourse Login on Android

public class DiscourseAuthAgent {
  // Randomly generated or static client id for your app
  private String clientId;
  
  // Random string to verify that the 
  // reply indeed comes from Discourse server
  private String nonce;
  
  // RSA Public key
  private String publicKey;
  
  // RSA Private key
  private String privateKey;

  // API key we get from the server
  private String apiKey;
}

String[] generateKeyPair(){
  String[] result = new String[2];
  
  // generate KeyPair
  KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
  kpg.initialize(2048);
  KeyPair keyPair = kpg.generateKeyPair();

  // get and base64 encode public key
  byte[] publicKey  = keyPair.getPublic().getEncoded();
  String b64PublicKey = Base64.encodeToString(publicKey, Base64.DEFAULT);
  result[0] = b64PublicKey;

  // get and base63 encode private key
  byte[] privateKey = keyPair.getPrivate().getEncoded();
  String b64PrivateKey = Base64.encodeToString(privateKey, Base64.DEFAULT);
  b64PublicKey[1] = b64PrivateKey;

  return result;
}

static String randomString(final int sizeOfRandomString) {
  // taken from https://stackoverflow.com/a/12116194/6611700
  String ALLOWED_CHARACTERS = 
    "0123456789qwertyuiopasdfghjklzxcvbnm";
  
  final Random random= new Random();
  final StringBuilder sb= new StringBuilder(sizeOfRandomString);
  
  for(int i=0;i<sizeOfRandomString;++i)
    sb.append(
      ALLOWED_CHARACTERS.charAt(
        random.nextInt(ALLOWED_CHARACTERS.length())
      )
    );
  return sb.toString();
}

/**
 * @param appName Your Application name that will be displayed to the user
 * @param scopes Permission scopes that you want (e.g. read, write)
 * @param redirectUri Uri to redirect to after authentication
 */
Uri generateAuthUri(String appName, String[] scopes, String redirectUri) {
  clientId = randomString(32 /* size */);
  nonce = randomString(16 /* size */);
  String[] rsaKeyPair = generateKeyPair();
  publicKey = rsaKeyPair[0];
  privateKey = rsaKeyPair[1];

  return Uri.parse(BASE_URL).buildUpon()
    .appendEncodedPath("user-api-key/new")
    .appendQueryParameter("scopes", TextUtils.join(",", scopes))
    .appendQueryParameter("client_id", clientId)
    .appendQueryParameter("nonce", nonce)
    .appendQueryParameter("auth_redirect", redirectUri)
    .appendQueryParameter("push_url", "https://api.discourse.org/api/publish_android")  // placeholder
    .appendQueryParameter("application_name", appName)
    .appendQueryParameter("public_key", getFormattedPublicKey(Base64.decode(rsaPublicKey, Base64.DEFAULT)))
    .build();
}

String getFormattedPublicKey(byte[] unformatted){
  String pkcs1pem = "-----BEGIN PUBLIC KEY-----\n";
  pkcs1pem += Base64.encodeToString(unformatted, Base64.DEFAULT);
  pkcs1pem += "-----END PUBLIC KEY-----";
  return pkcs1pem;
}

boolean handleAuthIntent(Intent data){
  if(null == data.getData())
    return false;
  
  try {
    String payload = java.net.URLDecoder.decode(
      redirection.getData().getQueryParameter("payload").replace("+", "%2B"),
      "UTF-8"
    ).replace("%2B", "+");

    // get back the private key
    byte[] privateKeyBytes = Base64.decode(privateKey, Base64.DEFAULT);
    PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(privateKeyBytes);
    PrivateKey privateKey = KeyFactory.getInstance("RSA").generatePrivate(spec);

    // initialize the Cipher
    Cipher cipher = Cipher.getInstance("RSA/NONE/PKCS1Padding");
    cipher.init(Cipher.DECRYPT_MODE, privateKey);

    // decrypt the payload into json
    byte[] decryptedBytes = cipher.doFinal(Base64.decode(payload, Base64.DEFAULT));
    String decrypted = new String(decryptedBytes);

    // create json object, verify nonce and let the fun begin!!!
    JSONObject payloadJson = new JSONObject(decrypted);

    // compare nonce
    if(!nonce.equals(payloadJson.getString("nonce")))
      throw new IllegalAccessException("invalid nonce");

    apiKey = payloadJson.getString("key");

    // and we are all done...
    return true;
  } catch (Exception e) {
    // failed to decrypt!
    // app must die :(
    throw new RuntimeException(e);
  }
}

<activity android:name=".LoginActivity" android:launchMode="singleTask">
  <!-- deep link redirection handler after authentication -->
  <intent-filter>
    <action android:name="android.intent.action.VIEW" />
    <category android:name="android.intent.category.DEFAULT" />
    <category android:name="android.intent.category.BROWSABLE" />
    <data android:scheme="discourse" android:host="auth_redirect" />
  </intent-filter>
</activity>

// on some button click
// redirect uri must be exactly the same, I tried with other but failed
Uri rediectTo = discourseAgent.generateAuthUri("My Amazing App", new String[]{ "read", "write" }, "discourse://auth_redirect");
CustomTabsIntent customTabsIntent = new CustomTabsIntent.Builder()
  .setToolbarColor(getResources().getColor(R.color.colorPrimary))
  .build();
customTabsIntent.launchUrl(this, redirectTo);

@Override protected void onNewIntent(Intent intent) {
  super.onNewIntent(intent);
  if(null != intent.getData() && intent.getData().toString().startsWith(REDIRECT_URI)){
    // redirection intent
    Timber.d("reply: %s", intent.getData());
    if(discourseAgent.handleAuthIntent(intent)){
      // authentication completed!
      Timber.d("Session authenticated!");
    } else {
      Timber.d("Failed to authenticate session :(");
    }
  }
}