Tolerate Authress redirects missing authenticationRequestId

[wparad]

Summary

Production logs showed a login redirect failing with "authentication request mismatch" even though only a single sign-in attempt was in flight:

19:30:51.194 [WARN] Authress: authentication request mismatch: pending=ZXUtY2VudHJhbHx1bmRlZmluZWR8..., redirect=
19:30:51.194 [ERROR] Authress: completeAuthenticationRequest() failed
19:30:51.193 [INFO] Authress: completeAuthenticationRequest() started (redirect received, authenticationRequestId=, code=present)

Authress's hosted redirect can come back with a valid code but no authenticationRequestId query parameter at all — not merely a different one. The existing mismatch check (added to detect stale redirects from an abandoned Custom Tab when a second sign-in attempt was started) treated this the same as a genuine mismatch and hard-failed the login, even though there was exactly one pending request and no ambiguity about which attempt the redirect belonged to.

• isRedirect() already confirms the deep link matches our exclusively-registered redirectUri, so when there's no abandoned/stale attempt in flight, a single pending authentication request is unambiguous.
• completeAuthenticationRequest() in AuthressLoginClient.kt now falls back to the stored pending request's ID when the redirect carries an empty authenticationRequestId and there is no known abandoned request to confuse it with, using that ID for the token exchange.
• The mismatch check still fails closed (as before) when the redirect's ID doesn't match a specific pending request, or when there's an abandoned attempt that makes an empty-ID redirect ambiguous — so the stale-tab detection this check exists for is preserved.

Test plan

• Manual sign-in on a device/emulator to confirm the login flow still completes normally
• Reasoned through the abandoned-request (double Custom Tab) case to confirm it still fails closed when ambiguous
• Not covered by automated tests — no existing test harness mocks AuthressLoginClient's network/Android dependencies

🤖 Generated with Claude Code

https://claude.ai/code/session_01TeHGwaVdcZzxoVWawejRM5

---

Generated by Claude Code