uber · lalwani · May 25, 2023 · May 25, 2023 · May 25, 2023 · May 26, 2023
diff --git a/.buildscript/deploy_snapshot.sh b/.buildscript/deploy_snapshot.sh
@@ -7,7 +7,7 @@
 
 SLUG="uber/rides-android-sdk"
 JDK="oraclejdk8"
-BRANCH="master"
+BRANCH="main"
 
 set -e
 

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -0,0 +1,63 @@
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Gradle Wrapper Validation
+        uses: gradle/actions/wrapper-validation@v4
+      - name: Install JDK
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'adopt'
+          java-version: '17'
+      - name: Lint and Unit tests
+        run: ./gradlew check --stacktrace
+      - name: Upload lint and test reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: execution-reports
+          path: |
+            ./core-android/build/reports
+            ./rides-android/build/reports
+  test:
+    runs-on: macOS-latest # enables hardware acceleration in the virtual machine, required for emulator testing
+    strategy:
+      matrix:
+        api-level: [ 26, 30, 33 ]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Gradle Wrapper Validation
+        uses: gradle/actions/wrapper-validation@v4
+      - name: Install JDK
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'adopt'
+          java-version: '17'
+  upload-snapshots:
+    runs-on: ubuntu-latest
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    needs:
+      - check
+      - test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Gradle Wrapper Validation
+        uses: gradle/actions/wrapper-validation@v4
+      - name: Install JDK
+        uses: actions/setup-java@v2
+        with:
+          distribution: 'adopt'
+          java-version: '17'
+      - name: Upload snapshots
+        run: ./gradlew publish --stacktrace
+        env:
+          ORG_GRADLE_PROJECT_SONATYPE_NEXUS_USERNAME: ${{ secrets.SonatypeUsername }}
+          ORG_GRADLE_PROJECT_SONATYPE_NEXUS_PASSWORD: ${{ secrets.SonatypePassword }}
diff --git a/.gitignore b/.gitignore
@@ -24,3 +24,4 @@ obj
 
 .DS_Store
 log.txt
+.vscode
diff --git a/.travis.yml b/.travis.yml
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,24 +1,87 @@
-v0.10.1 - TBD
+v2.0.5 - 06/26/2026
 -------------
 
+### Added
+- [PR #272](https://github.com/uber/rides-android-sdk/pull/272) SDK always generates and validates `state` parameter to protect against CSRF attacks
+- [PR #275](https://github.com/uber/rides-android-sdk/pull/275) Introduce `AuthOptionalConfig` data class grouping optional auth parameters; old 6-parameter `AuthContext` constructor deprecated with `ReplaceWith`
+- [PR #279](https://github.com/uber/rides-android-sdk/pull/279) SDK auto-generates `nonce` when caller does not supply one
+- [PR #277](https://github.com/uber/rides-android-sdk/pull/277) Add `NonceUtil.extractNonceFromIdToken` for extracting nonce claim from JWT `id_token` payload
+
+### Fixed
+- [PR #278](https://github.com/uber/rides-android-sdk/pull/278) PKCE flow always validates the `nonce` claim in the `id_token` response; mismatch returns `INVALID_NONCE` error
+
+v2.0.4 - 06/16/2026
+-------------
+
+### Added
+- [PR #271](https://github.com/uber/rides-android-sdk/pull/271) Forward optional nonce parameter on `/authorize` request
+
+### Fixed
+- [PR #270](https://github.com/uber/rides-android-sdk/pull/270) Fix resource linking issue by adding `ubb__signin_margin`
+
+v2.0.3 - 05/20/2026
+-------------
+
+### Added
+- [PR #268](https://github.com/uber/rides-android-sdk/pull/268) Added `UberEnvironment` enum and `environment` parameter on `AuthContext` to let 3P developers target sandbox vs production environments
+
+### Fixed
+- [PR #265](https://github.com/uber/rides-android-sdk/pull/265) Handle PAR (pushed authorization request) failures gracefully to continue authentication without metadata
+
+v0.10.8 - 09/22/2023
+-------------
+
+### Update
+- Updated [rides-java-sdk](https://github.com/uber/rides-java-sdk) version to 0.8.4
+
+v0.10.7 - 08/17/2023
+-------------
+
+### Fixed
+- [Issue #204](https://github.com/uber/rides-android-sdk/issues/204) NullPointerException when login via SSO with pushed authorization request
+
+v0.10.4 - 05/26/2023
+-------------
+
+### Added
+- [Issue #194](https://github.com/uber/rides-android-sdk/issues/194) Integrated Login Pushed authorization request flow
+- [Issue #193](https://github.com/uber/rides-android-sdk/issues/193) Deprecating embedded webviews
+- Updated java version to 1.8
+- Updated login endpoint to auth.uber.com from login.uber.com
+- Replaced jcenter with mavenCentral
+
+v0.10.3 - 08/19/2021
+-------------
+
+v0.10.2 - 12/03/2019
+-------------
+
+v0.10.1 - 02/27/2019
+-------------
+
+### Fixed
+- [Issue #153](https://github.com/uber/rides-android-sdk/issues/153) NullPointerException when login via SSO without setting product flow priority
+- [Issue #151](https://github.com/uber/rides-android-sdk/issues/151) Login throws IllegalStateException when using only CustomScopes
+
+
 v0.10.0 - 12/14/2018
 ------------
 
 ### Added
- - [Issue #144](https://github.com/uber/rides-android-sdk/issues/144) Allow SSO Client to dictate which Uber Apps can be used for SSO
- - [Issue #138](https://github.com/uber/rides-android-sdk/issues/138) Support for IETF RFC 8252
- - [Issue #130](https://github.com/uber/rides-android-sdk/issues/130) Support for Uber Eats SSO
+- [Issue #144](https://github.com/uber/rides-android-sdk/issues/144) Allow SSO Client to dictate which Uber Apps can be used for SSO
+- [Issue #138](https://github.com/uber/rides-android-sdk/issues/138) Support for IETF RFC 8252
+- [Issue #130](https://github.com/uber/rides-android-sdk/issues/130) Support for Uber Eats SSO
 
 ### Fixed
- - [Issue #129](https://github.com/uber/rides-android-sdk/issues/129) Allow use of refresh token for non-privileged scopes
- - [Issue #119](https://github.com/uber/rides-android-sdk/issues/119) Redirect URL documentation issue
+- [Issue #129](https://github.com/uber/rides-android-sdk/issues/129) Allow use of refresh token for non-privileged scopes
+- [Issue #119](https://github.com/uber/rides-android-sdk/issues/119) Redirect URL documentation issue
 
 v0.9.1 - 03/20/2018
 ------------
 
 ### Fixed
- - [Issue #115](https://github.com/uber/rides-android-sdk/issues/115) Release Script is creating invalid release notes/download artifacts.
- - Updated to Java SDK 0.8.0 to fix Token Refresh NPE
+- [Issue #115](https://github.com/uber/rides-android-sdk/issues/115) Release Script is creating invalid release notes/download artifacts.
+- Updated to Java SDK 0.8.0 to fix Token Refresh NPE
 
 
 v0.9.0 - 02/13/2018
@@ -29,16 +92,16 @@ v0.9.0 - 02/13/2018
   over deprecated Ride Request Widget
 
 ### Fixed
- - [Issue #105](https://github.com/uber/rides-android-sdk/issues/105) onReceivedError and onReceivedHttpError does not work on API level < 23
+- [Issue #105](https://github.com/uber/rides-android-sdk/issues/105) onReceivedError and onReceivedHttpError does not work on API level < 23
 
 v0.8.0 - 02/09/2018
 ------------
 
 ### Changed
- - [Issue #101](https://github.com/uber/rides-android-sdk/issues/101) LoginManager now uses AccessTokenStorage
+- [Issue #101](https://github.com/uber/rides-android-sdk/issues/101) LoginManager now uses AccessTokenStorage
 
 ### Added
- - [Issue #22](https://github.com/uber/rides-android-sdk/issues/22) Customtab support
+- [Issue #22](https://github.com/uber/rides-android-sdk/issues/22) Customtab support
 
 
 v0.7.0 - 11/17/2017
@@ -53,7 +116,7 @@ v0.7.0 - 11/17/2017
 v0.6.1 - 4/5/2017
 -------------------
 ### Changed
- - AuthUtils now omits unrecognized scopes from parsed AccessToken instead of throwing an exception when creating
+- AuthUtils now omits unrecognized scopes from parsed AccessToken instead of throwing an exception when creating
 
 v0.6.0 - 2/14/2017
 -------------------
@@ -152,7 +215,7 @@ v0.3.1 - 4/18/2016
 ### Fixed
 
 - [Issue #15] (https://github.com/uber/rides-android-sdk/issues/15) RideRequestView correctly handles redirecting to
-call or message the driver
+  call or message the driver
 
 v0.3.0 - 4/11/2016
 ------------------
@@ -208,8 +271,8 @@ Currently available `requestingBehaviors` are:
 
 v0.2.0 - 2/3/2016
 ------------------
-  - Localization of request button text for zh-rCN.
+- Localization of request button text for zh-rCN.
 
 v0.1.0 - 11/24/2015
 ------------------
-  - Initial version.
+- Initial version.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,44 @@
+# Contributing to rides-android-sdk
+
+Uber welcomes contributions of all kinds and sizes. This includes everything from from simple bug reports to large features.
+
+Before we can accept your contributions, we kindly ask you to sign our [Contributor License Agreement](https://cla-assistant.io/uber/rides-android-sdk).
+
+Workflow
+--------
+
+We love GitHub issues!
+
+For small feature requests, an issue first proposing it for discussion or demo implementation in a PR suffice.
+
+For big features, please open an issue so that we can agree on the direction, and hopefully avoid investing a lot of time on a feature that might need reworking.
+
+Small pull requests for things like typos, bug fixes, etc are always welcome.
+
+### Code style
+
+This project uses kotlin formatting provided via the [spotless](https://github.com/diffplug/spotless) gradle plugin.
+
+If you find that one of your pull reviews does not pass the CI server check due to a code style
+conflict, you can easily fix it by running: `./gradlew spotlessApply`.
+
+Generally speaking - we use ktfmt, vanilla ktlint + 2space indents, and vanilla GJF. You can integrate both of
+these in IntelliJ code style via either [GJF's official plugin](https://plugins.jetbrains.com/plugin/8527-google-java-format) or applying code style from Jetbrains' official style.
+
+No star imports please!
+
+DOs and DON'Ts
+--------------
+
+* DO follow our [coding style](https://github.com/uber/java-code-styles)
+* DO include tests when adding new features. When fixing bugs, start with adding a test that highlights how the current behavior is broken.
+* DO keep the discussions focused. When a new or related topic comes up it's often better to create new issue than to side track the discussion.
+
+* DON'T submit PRs that alter licensing related files or headers. If you believe there's a problem with them, file an issue and we'll be happy to discuss it.
+
+Guiding Principles
+------------------
+
+* We allow anyone to participate in our projects. Tasks can be carried out by anyone that demonstrates the capability to complete them
+* Always be respectful of one another. Assume the best in others and act with empathy at all times
+* Collaborate closely with individuals maintaining the project or experienced users. Getting ideas out in the open and seeing a proposal before it's a pull request helps reduce redundancy and ensures we're all connected to the decision making process
diff --git a/MIGRATION.md b/MIGRATION.md
@@ -0,0 +1,79 @@
+# Authentication Migration Guide from old sdk (version 0.10.X and below) to new sdk (2.X and above)
+
+We've simplified the SDK for consumers by providing a single point of entry. Information passing from the client app to the library is now divided into two parts:
+
+1. **Static Information**: Provided as a one-time configuration with the `sso_config.json` file.
+2. **Dynamic Information**: Contains parameters that can change over time, such as the type of flow needed, prefill information, use of SSO, or in-app authentication.
+
+For detailed SDK integration documentation, please refer to the [authentication guide](https://github.com/uber/rides-android-sdk/tree/2.x/authentication).
+
+This guide focuses on modifying your codebase when migrating from the older 0.10.X version of the SDK to the 2.X version.
+
+## Steps to Follow:
+
+### 1. Providing Application Information
+- Remove `UBER_CLIENT_ID` and `UBER_REDIRECT_URI` entries from the `gradle.properties` file.
+- Create a `sso_config.json` file in your application's `res/raw` folder with the following details:
+
+    ```json
+    {
+      "client_id": "YOUR_CLIENT_ID",
+      "redirect_uri": "YOUR_APPLICATION_ID.uberauth://redirect",
+      "scope": "YOUR_SCOPES COMMA SEPARATED"
+    }
+    ```
+
+### 2. Deprecating `SessionConfiguration` Object
+- Remove references to the `SessionConfiguration` object built like this:
+
+    ```java
+    SessionConfiguration configuration = new SessionConfiguration.Builder()
+        .setClientId(CLIENT_ID)
+        .setRedirectUri(REDIRECT_URI)
+        .setScopes(Arrays.asList(Scope.PROFILE, Scope.RIDE_WIDGETS))
+        .setProfileHint(new ProfileHint
+            .Builder()
+            .email("john@doe.com")
+            .firstName("John")
+            .lastName("Doe")
+            .phone("1234567890")
+            .build())
+        .build();
+    ```
+
+- Instead, use `AuthContext`:
+
+    ```java
+    AuthContext authContext = new AuthContext(
+            new AuthDestination.CrossAppSso(),
+            new AuthType.PKCE(),
+            new PrefillInfo(
+                    "john@doe.com",
+                    "John",
+                    "Doe",
+                    "1234567890"
+            )
+    );
+    ```
+
+### 3. Replace `LoginManager` with `UberAuthClient`
+
+Replace
+
+```java
+LoginManager loginManager = new LoginManager(accessTokenStorage,
+        new SampleLoginCallback(),
+        configuration,
+        CUSTOM_BUTTON_REQUEST_CODE);
+loginManager.login(LoginSampleActivity.this);
+```
+with
+
+```java
+UberAuthClient uberAuthClient = new UberAuthClientImpl();
+uberAuthClient.authenticate(LoginSampleActivity.this, authContext);
+```
+
+### 4. Custom buttons (Future)
+
+The Uber custom buttons provide apis for `setSessionConfiguration()` `setCallback()` and `setRequestCode()` with the changes in the authentication module we will not be needing these anymore as there will be only one entry point for authentication module of the sdk