🏗️ Architecture: How should Vitto desktop app handle authentication?

Date: 2026-02-25
Time: 02:13:03 UTC
Session: gspace1-141.2
Agent: angular
Confidence: 90%
Status: ✅ Documented

📋 Decision Context

Question:

How should Vitto desktop app handle authentication?

Task: Vitto desktop smart login system

🎯 Decision Made

Chosen:

VSCode-style deep link OAuth: open system browser → user logs in → vitto://auth?token=... redirects back → Tauri captures deep link → emits event to Angular WebView → app reloads authenticated

Options Considered:

• No alternatives documented

💭 Reasoning

Previous approach (window.location.href in WebView) navigated the app itself to gograb.space — completely wrong. System browser approach: (1) works even if user is already logged in (zero-click), (2) keeps Vitto UI visible throughout, (3) is the exact pattern VSCode/Spotify/Linear use, (4) no credentials stored in WebView localStorage directly. Uses tauri-plugin-deep-link for vitto:// URL scheme registration on macOS. GoGrab web app detects ?desktop=true and redirects to vitto:// after successful login.

📁 Files Involved

• apps/vitto-desktop/src-tauri/src/lib.rs
• apps/vitto-desktop/src-tauri/Cargo.toml
• apps/vitto-desktop/src-tauri/tauri.conf.json
• apps/gograb-ai/src/app/pages/desktop-welcome/desktop-welcome.component.ts
• apps/gograb-ai/src/app/app.component.ts
• apps/gograb-ai/src/app/core/services/tauri-bridge.service.ts

🔗 Related

• Decision ID: dev_1771985583119_kjxndbr
• Session: 141
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation