fix: align paykit auth sheet with figma

[jvsena42]

This PR aligns the Paykit authorization sheet with the Auth (paykit) flow in Figma.

Description

• Earn consent: swaps the illustration for the three-coin stack the frame uses and draws it at the frame's scale, drops the extra 16dp side inset so the copy and buttons span the sheet width, and sets the gaps around the illustration to 32dp.
• Authorize: names the requester in the lead sentence (app.paykit.server is requesting permission…) and removes the separate Requester ID line. The old sentence stays as the fallback when a request carries no client id.
• Authorize: groups the content under REQUESTED PERMISSIONS, DETAILS and BEFORE YOU CONTINUE headings with 32dp between sections, removes the divider under the permissions, uses the Figma copy for the Paykit details and trust warning, and sets both to the 15sp body style.
• Authorize: pins the trust warning and the profile card to the bottom of the sheet; the sections above scroll when they do not fit.
• Profile card: replaces the centered 96dp avatar card with the compact row (48dp avatar, truncated key above the name). This applies to every Pubky auth dialog, as the design now uses it for all of them.
• Authorizing: sets the label to the 15sp button text style and gives it the button's height so the content above no longer shifts when the buttons are replaced.
• Success: names the requester in the summary sentence, insets the text 32dp from the sheet edges and draws the check illustration at the frame's scale. The content scrolls when a long requester id does not fit, so the OK button stays on screen.
• The requester id and service name are shown literally: <accent> tags, line breaks, bidi controls and other invisible characters in them are removed before the sentence is styled, so a request cannot inject emphasis, add lines or reorder the sentence. A long id wraps in full.
• Permission row: folder icon is 16dp and gains the duotone tab from the Figma icon.

Out of Scope

• strings.xml: the Figma title reads "Authorization Succesful"; the existing correctly spelled "Authorization Successful" is kept.
• Authorize paykit FaceID frame: the Face ID prompt is the iOS system dialog; Android keeps its own biometric/PIN prompt.
• Type.kt: body styles keep the app-wide 0.4sp letter spacing where the frames show 0.
• Translations: the new and changed strings are English only.
• bitkit-ios: ported in fix: align paykit auth sheet with figma bitkit-ios#880.

Design

• Earn bitcoin with your content
• Authorize paykit
• Authorize paykit FaceID
• Authorized

Preview

Pixel 9 emulator, dev build, combined paykit-access-v1.watch-only-account-v1 claim.

Screen	Before / After / Figma
Earn consent
Authorize
Authorizing
Success

QA Notes

Journeys

N/A — no journey added or updated. The route and test tags are unchanged, so wallet-leg.xml and paykit-only-approval.xml still drive this sheet as written.

Manual Tests

• Open a pubkyauth://signin_grant URL with caps=/pub/paykit/:rw, a cid and x-bitkit-claim=paykit-access-v1.watch-only-account-v1 → the Earn, Authorize, Authorizing and Success screens match the Figma frames above — needs a valid auth URL fixture.
• Open a Pubky auth URL without a Bitkit claim → the Authorize screen shows the compact profile card and no DETAILS section — needs a valid auth URL fixture.

Automated Checks

• updated PubkyAuthApprovalSheetTest.kt — accent tags in a requester id are removed, including nested ones, and so are line breaks and bidi controls
• ran just compile, just test, just lint — pass locally.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no new actionable issue was established.

Summary

The PR updates Pubky authorization dialogs to match the supplied design.

• Authorization and success screens name the requesting app.
• Authorization details sit above the trust note and profile card.
• The watch-only consent screen uses the Figma coin artwork and spacing.
• The success screen keeps its OK button visible when the text is long.
• The authorizing label keeps the button's height.

_{Reviews (2) · Last reviewed commit: "fix: drop control and bidi characters fr..." · Reviewed by Greptile}

[github-actions]

Regtest APK

Built from fd722c3 (run).

Download bitkit-dev-debug universal APK (expires in 30 days).

[piotr-iohk]

QA review

Scope: Full review of the complete pull request diff against merge base 50c9bc34, at 1dcb6ad. No earlier assessment baseline was available.

2 actionable findings — resolve or provide an evidence-backed rebuttal.

The grant, local unlock, and capabilities path are unchanged. Consent copy matches the linked Figma frames and the comparison revision 12e44e9 on bitkit-ios#880. wallet-leg.xml, paykit-only-approval.xml, and paykit-reconnect.xml still match the Paykit details sentence and the existing test tags. An earlier note about a non-scrolling footer is already addressed here: the warning and profile scroll with the details when the column is taller than the sheet (thread).

Validation: Inspected PubkyAuthApprovalSheetTest (accent-tag stripping only). I did not run unit tests or a device. On this commit, GitHub CI build, lint, and the local e2e matrix 37923940835 succeeded. Those e2e jobs do not open this sheet. Device testing: not performed in this review. iOS was comparison-only, not a full review.

Non-blocking consistency suggestions: The Authorize frame stacks Before you continue and the profile directly under the details, with the spare space above the buttons. This sheet, like iOS, expands a spacer so that group sits on the bottom when the content is short. iOS still joins every service name with "and"; Android still shows only the first. The success check is scaled uniformly in a 256dp slot; the Authorized frame places a 274×206 image inside a 256×192 frame.

Suggested additional test cases:

• Android, dev build, pubkyauth://signin_grant whose cid is longer than the sheet text width and has no spaces: open Authorize and Success. The requester is fully visible or ellipsized, and the permission sentence stays fully visible.
• Android, same flow, with a cid that contains an encoded newline plus a second sentence, and one that contains a bidi override: the sheet shows one consent sentence in the app's word order, with no extra line.
• Android earn consent on a phone-width sheet: the coin stays clear of the title, matching the Earn frame.

Findings

• [MEDIUM] Isolate requester text in the consent sentence — inline at app/src/main/java/to/bitkit/ui/screens/profile/PubkyAuthApprovalSheet.kt:510.
• [LOW] Clip the earn coin to its illustration frame — inline at app/src/main/java/to/bitkit/ui/screens/profile/PubkyAuthApprovalSheet.kt:298.

[talosmachina]

No findings. Aligns the Pubky auth approval sheet with the Paykit auth frames: the requester named in the lead and success sentences, sectioned permissions, details and trust warning, a compact profile card, and request text rendered literally. Reviewed fd722c3, full tier (the sheet is on the auth approval path), reasoned from the code and CI: per the repo's agent rules the Android branch is not built on the reviewing machine, so the layout was not run on a device here.

What I checked, and 5 candidates I ruled out

Read in full: PubkyAuthApprovalSheet.kt, PubkyAuthApprovalSheetTest.kt, the strings.xml hunk, ui/utils/Text.kt (withAccent, removeAccentTags)
Call sites traced: clientId and serviceName from PubkyRepo.parseAuthUrl through PubkyAuthRequest.parse / parseSignup / parseGrantSignup into PubkyAuthApprovalViewModel.load
CI: build, build-local, lint, detekt, Greptile green; 7 e2e-tests-local shards still pending at review time

Ruled out

• Markup injection through the request text: hidden characters are dropped before the accent strip, and the strip repeats until stable, so a tag split by a zero-width or nested inside another cannot survive into withAccentBoldBright. A fragment like x</acc next to the template's own </accent> cannot open a new span; the regex is non-greedy and at worst bolds the fragment inside the requester's own span. Covered by the two new tests.
• Signup requests losing the sentence: parseSignup passes clientId = "", which takes the profile__auth_approval_service / success_detail fallback, so the signup flow keeps the old wording.
• Requester id is caller-chosen: cid is whatever the requesting app puts in the URL; the sheet already showed it before this PR as Requester ID, and naming it in the lead sentence is the linked frame's choice, so not a regression introduced here.
• Removed or reworded strings with stale translations: no values-* locale carries profile__auth_approval_requester, paykit_access_title, paykit_access_description or trust_warning, so nothing dangles.
• Journeys asserting the old text or tags: paykit-only-approval.xml, paykit-reconnect.xml, wallet-leg.xml and the two pubky-auth journeys assert on PubkyAuthPaykitAccess, PubkyAuthAuthorize, PubkySignupHomeserver and PubkyAuthOK, all kept, and their prose (no spending keys shared, profile name and key shown) still matches the new copy and card.

Merge confidence: 4/5, the e2e shards were still running and the layout change was not exercised on a device by this review.

[piotr-iohk]

QA review

Scope: Re-reviewed the full PR at fd722c33 after the comparison base changed and no verified baseline was available to inherit. This pass covers the complete diff from merge base 3cac93b0.

No new actionable code findings.

The grant path is unchanged: local PIN or biometric unlock still runs, and approval still submits the raw client id, capabilities, and companion claim. Literal display filtering applies only to the requester id and service name in the authorize and success sentences. asLiteralRequestText drops control, format, line-separator, and paragraph-separator characters, then removes <accent> tags, including tags rebuilt by nesting or by deleting invisible characters. A Java replica of that filter produced the same results as the new PubkyAuthApprovalSheetTest cases. String.format leaves % inside those values as literal text.

The open consent-sentence thread describes newline and bidi-override injection from 1dcb6ad. At this revision those characters are removed before the sentence is styled. The sentence uses unbounded soft-wrapped body text, so an overlong id is a wrapping run. This review did not render that layout. The author reports a 229-character id wrapping on a Pixel 9 at this commit. The open coin thread assumes a solid 329dp bitmap. The opaque pixels of coin_stack_4.png end about 21dp above the bottom of the 256dp slot after the 329/256 scale and 7dp downward shift, and the 32dp spacer sits below that.

iOS 508c58f0 on bitkit-ios#880 uses the same character filter and sentence structure. That comparison is limited to this sheet.

Non-blocking consistency suggestions: Android still names only the first service in the lead sentence. iOS joins every service name with "and". Both platforms list every permission path. The Android first-service choice is unchanged by this layout.

Validation: Gradle and a device were not run here. GitHub unit tests and lint succeeded on this revision. wallet-leg.xml, paykit-only-approval.xml, and paykit-reconnect.xml still match the Paykit details wording and the existing test tags. Local e2e shards were still running and do not open this sheet.

Device testing: not performed in this review.

Ready for device testing.

[piotr-iohk]

Tested a local build of fd722c3 on an Android emulator. Focused smoke passed: Earn → Authorize → Success → OK, cancellation, reopening with a fresh requester, and a 253-character requester at font scale 2.0. Verified the requester, permissions, details and trust warning remained readable by scrolling, and the controls remained usable. Restored the normal text setting afterward.

Authorization used a controlled local relay. This was a focused UI smoke; physical hardware and PIN/biometric prompts were not tested.