fix auth flows

apps/weblibre/lib/features/app_links/domain/services/app_link_policy_replication.dart

@@ -110,6 +110,7 @@ AppLinkPolicySnapshot? appLinkPolicySnapshot(Ref ref) {
         key: _toNativeRule(value),
     },
     marketplaceFallbackEnabled: settings.appLinkMarketplaceFallback,
+    authExceptionsEnabled: settings.appLinkAuthExceptionsEnabled,
     protectGeneralContext: protection.protectGeneralContext,
     protectedContextIds: protection.protectedContextIds.toList(),
     strictContextIds: protection.strictContextIds.toList(),

apps/weblibre/lib/features/app_links/domain/services/app_link_policy_replication.g.dart

@@ -120,7 +120,7 @@ final class AppLinkPolicySnapshotProvider
 }
 
 String _$appLinkPolicySnapshotHash() =>
-    r'6fe2dca118d7162561fc7f6280d1a0411d50972a';
+    r'4d456a3cbf091e95ac35d913e8fa20d5f25978ab';
 
 /// Single serialised writer that mirrors the Dart-owned app-link policy to the
 /// native profile-scoped store (§2.8), the sole policy source consulted by the

apps/weblibre/lib/features/geckoview/domain/repositories/tab.g.dart

@@ -41,7 +41,7 @@ final class TabRepositoryProvider
   }
 }
 
-String _$tabRepositoryHash() => r'797520166026d1f0272cf713aa1c25ecf129c236';
+String _$tabRepositoryHash() => r'5824be32664bac24623cf8863f68b7afa254d025';
 
 abstract class _$TabRepository extends $Notifier<void> {
   void build();

apps/weblibre/lib/features/geckoview/features/browser/domain/providers.g.dart

@@ -1397,8 +1397,8 @@ final class VisibleTabListItemsFamily extends $Family
 /// switcher lays them out — the unassigned bucket first, then containers by
 /// pinned/`order_key`. Stepping off the end of one container therefore
 /// continues into the next, and selecting that tab moves the selected container
-/// along with it. Containers without tabs are skipped so their tree query never
-/// runs.
+/// along with it. Named containers holding no tabs are skipped so their tree
+/// query never runs.
 ///
 /// "Previous" is a step towards the top of that order and "next" a step
 /// towards its end, so direction follows `tabListDirection` (baked into the
@@ -1443,8 +1443,8 @@ final sequentialTabNavigationOrderProvider =
 /// switcher lays them out — the unassigned bucket first, then containers by
 /// pinned/`order_key`. Stepping off the end of one container therefore
 /// continues into the next, and selecting that tab moves the selected container
-/// along with it. Containers without tabs are skipped so their tree query never
-/// runs.
+/// along with it. Named containers holding no tabs are skipped so their tree
+/// query never runs.
 ///
 /// "Previous" is a step towards the top of that order and "next" a step
 /// towards its end, so direction follows `tabListDirection` (baked into the
@@ -1493,8 +1493,8 @@ final class SequentialTabNavigationOrderProvider
   /// switcher lays them out — the unassigned bucket first, then containers by
   /// pinned/`order_key`. Stepping off the end of one container therefore
   /// continues into the next, and selecting that tab moves the selected container
-  /// along with it. Containers without tabs are skipped so their tree query never
-  /// runs.
+  /// along with it. Named containers holding no tabs are skipped so their tree
+  /// query never runs.
   ///
   /// "Previous" is a step towards the top of that order and "next" a step
   /// towards its end, so direction follows `tabListDirection` (baked into the

apps/weblibre/lib/features/settings/presentation/screens/browsing_settings.dart

@@ -817,6 +817,11 @@ class _AppLinksModeSection extends HookConsumerWidget {
         (s) => s.appLinkMarketplaceFallback,
       ),
     );
+    final authExceptionsEnabled = ref.watch(
+      generalSettingsWithDefaultsProvider.select(
+        (s) => s.appLinkAuthExceptionsEnabled,
+      ),
+    );
     final rules = ref.watch(
       generalSettingsWithDefaultsProvider.select((s) => s.appLinkRules),
     );
@@ -887,6 +892,23 @@ class _AppLinksModeSection extends HookConsumerWidget {
                         );
                   },
           ),
+          SwitchListTile.adaptive(
+            contentPadding: EdgeInsets.zero,
+            title: const Text('Allow login app callbacks'),
+            subtitle: const Text(
+              'Let apps that opened a Custom Tab receive their login callback, '
+              'even when links are set to never open in apps',
+            ),
+            value: authExceptionsEnabled,
+            onChanged: (value) async {
+              await ref
+                  .read(saveGeneralSettingsControllerProvider.notifier)
+                  .save(
+                    (current) =>
+                        current.copyWith.appLinkAuthExceptionsEnabled(value),
+                  );
+            },
+          ),
           _AppLinkRulesSubsection(rules: rules),
         ],
       ),

apps/weblibre/lib/features/user/data/models/general_settings.dart

@@ -252,6 +252,12 @@ class GeneralSettings with FastEquatable {
   /// Defaults to false — the wrong default for a de-Googled browser.
   final bool appLinkMarketplaceFallback;
 
+  /// Whether app-link "never" rules allow a same-caller Custom Tab / ActionView
+  /// login callback to return to the app that opened the browser. Defaults to
+  /// true to keep OAuth-style sign-in flows working while normal app links still
+  /// obey [appLinksMode].
+  final bool appLinkAuthExceptionsEnabled;
+
   /// Whether the local search index (`history` table populated via tab→
   /// history triggers) is active. When false, the SQL trigger guard returns
   /// without writing; existing rows stay until the user clears them.
@@ -359,6 +365,7 @@ class GeneralSettings with FastEquatable {
     required this.appLinkRules,
     required this.appLinkContextOverrides,
     required this.appLinkMarketplaceFallback,
+    required this.appLinkAuthExceptionsEnabled,
     required this.enableLocalSearchIndex,
     required this.indexPrivateTabs,
     required this.acceptSuggestionOnSubmit,
@@ -436,6 +443,7 @@ class GeneralSettings with FastEquatable {
     Map<String, PersistedAppLinkRule>? appLinkRules,
     Map<String, ContextAppLinkPolicy>? appLinkContextOverrides,
     bool? appLinkMarketplaceFallback,
+    bool? appLinkAuthExceptionsEnabled,
     bool? enableLocalSearchIndex,
     bool? indexPrivateTabs,
     bool? acceptSuggestionOnSubmit,
@@ -524,6 +532,7 @@ class GeneralSettings with FastEquatable {
        appLinkRules = appLinkRules ?? const {},
        appLinkContextOverrides = appLinkContextOverrides ?? const {},
        appLinkMarketplaceFallback = appLinkMarketplaceFallback ?? false,
+       appLinkAuthExceptionsEnabled = appLinkAuthExceptionsEnabled ?? true,
        enableLocalSearchIndex = enableLocalSearchIndex ?? true,
        indexPrivateTabs = indexPrivateTabs ?? false,
        acceptSuggestionOnSubmit = acceptSuggestionOnSubmit ?? true,
@@ -693,6 +702,7 @@ class GeneralSettings with FastEquatable {
     appLinkRules,
     appLinkContextOverrides,
     appLinkMarketplaceFallback,
+    appLinkAuthExceptionsEnabled,
     enableLocalSearchIndex,
     indexPrivateTabs,
     acceptSuggestionOnSubmit,

apps/weblibre/lib/features/user/data/models/general_settings.g.dart

@@ -161,6 +161,10 @@ abstract class _$GeneralSettingsCWProxy {
 
   GeneralSettings appLinkMarketplaceFallback(bool appLinkMarketplaceFallback);
 
+  GeneralSettings appLinkAuthExceptionsEnabled(
+    bool appLinkAuthExceptionsEnabled,
+  );
+
   GeneralSettings enableLocalSearchIndex(bool enableLocalSearchIndex);
 
   GeneralSettings indexPrivateTabs(bool indexPrivateTabs);
@@ -253,6 +257,7 @@ abstract class _$GeneralSettingsCWProxy {
     Map<String, PersistedAppLinkRule> appLinkRules,
     Map<String, ContextAppLinkPolicy> appLinkContextOverrides,
     bool appLinkMarketplaceFallback,
+    bool appLinkAuthExceptionsEnabled,
     bool enableLocalSearchIndex,
     bool indexPrivateTabs,
     bool acceptSuggestionOnSubmit,
@@ -556,6 +561,11 @@ class _$GeneralSettingsCWProxyImpl implements _$GeneralSettingsCWProxy {
   GeneralSettings appLinkMarketplaceFallback(bool appLinkMarketplaceFallback) =>
       call(appLinkMarketplaceFallback: appLinkMarketplaceFallback);
 
+  @override
+  GeneralSettings appLinkAuthExceptionsEnabled(
+    bool appLinkAuthExceptionsEnabled,
+  ) => call(appLinkAuthExceptionsEnabled: appLinkAuthExceptionsEnabled);
+
   @override
   GeneralSettings enableLocalSearchIndex(bool enableLocalSearchIndex) =>
       call(enableLocalSearchIndex: enableLocalSearchIndex);
@@ -665,6 +675,7 @@ class _$GeneralSettingsCWProxyImpl implements _$GeneralSettingsCWProxy {
     Object? appLinkRules = const $CopyWithPlaceholder(),
     Object? appLinkContextOverrides = const $CopyWithPlaceholder(),
     Object? appLinkMarketplaceFallback = const $CopyWithPlaceholder(),
+    Object? appLinkAuthExceptionsEnabled = const $CopyWithPlaceholder(),
     Object? enableLocalSearchIndex = const $CopyWithPlaceholder(),
     Object? indexPrivateTabs = const $CopyWithPlaceholder(),
     Object? acceptSuggestionOnSubmit = const $CopyWithPlaceholder(),
@@ -1061,6 +1072,12 @@ class _$GeneralSettingsCWProxyImpl implements _$GeneralSettingsCWProxy {
           ? _value.appLinkMarketplaceFallback
           // ignore: cast_nullable_to_non_nullable
           : appLinkMarketplaceFallback as bool,
+      appLinkAuthExceptionsEnabled:
+          appLinkAuthExceptionsEnabled == const $CopyWithPlaceholder() ||
+              appLinkAuthExceptionsEnabled == null
+          ? _value.appLinkAuthExceptionsEnabled
+          // ignore: cast_nullable_to_non_nullable
+          : appLinkAuthExceptionsEnabled as bool,
       enableLocalSearchIndex:
           enableLocalSearchIndex == const $CopyWithPlaceholder() ||
               enableLocalSearchIndex == null
@@ -1257,6 +1274,7 @@ GeneralSettings _$GeneralSettingsFromJson(
     json['appLinkContextOverrides'] as Map<String, dynamic>?,
   ),
   appLinkMarketplaceFallback: json['appLinkMarketplaceFallback'] as bool?,
+  appLinkAuthExceptionsEnabled: json['appLinkAuthExceptionsEnabled'] as bool?,
   enableLocalSearchIndex: json['enableLocalSearchIndex'] as bool?,
   indexPrivateTabs: json['indexPrivateTabs'] as bool?,
   acceptSuggestionOnSubmit: json['acceptSuggestionOnSubmit'] as bool?,
@@ -1356,6 +1374,7 @@ Map<String, dynamic> _$GeneralSettingsToJson(
     (k, e) => MapEntry(k, e.toJson()),
   ),
   'appLinkMarketplaceFallback': instance.appLinkMarketplaceFallback,
+  'appLinkAuthExceptionsEnabled': instance.appLinkAuthExceptionsEnabled,
   'enableLocalSearchIndex': instance.enableLocalSearchIndex,
   'indexPrivateTabs': instance.indexPrivateTabs,
   'acceptSuggestionOnSubmit': instance.acceptSuggestionOnSubmit,

apps/weblibre/lib/features/user/domain/repositories/general_settings.dart

@@ -109,6 +109,7 @@ const generalSettingColumnTypes = <String, DriftSqlType>{
   'customTabsEnabled': DriftSqlType.bool,
   'appLinksMode': DriftSqlType.string,
   'appLinkMarketplaceFallback': DriftSqlType.bool,
+  'appLinkAuthExceptionsEnabled': DriftSqlType.bool,
   'enableLocalSearchIndex': DriftSqlType.bool,
   'indexPrivateTabs': DriftSqlType.bool,
   'acceptSuggestionOnSubmit': DriftSqlType.bool,