[alperozturk96]

How to reproduce?

1. Create a user that has an email address
2. Log in with the username e.g. testuser.
3. Revoke the app's token from web. Settings → Security → Devices & sessions and revoke the Android device.
4. Trigger reauthentication. In the app, pull to refresh the file list. When the app asks for new credentials, open the login flow.
5. Log in with the email this time not username.
   • With the fix: the login screen says "Log in with username to update this account", and the app doesn't save anything.
   • Without the fix the login appears to succeed, but the app then gets 401s and asks you to log in again.

Now we can inform user

[github-actions]

SpotBugs

Category	Base	New
Bad practice	24	24
Correctness	45	45
Dodgy code	145	145
Experimental	1	1
Malicious code vulnerability	1	1
Multithreaded correctness	13	13
Performance	28	28
Security	15	15
Total	272	272

[github-actions]

📱 QA build

Download	app-qa-debug.apk
QR code	Open the QR code for this download
Commit	4deb914
Version	17943
Available until	7 days after this build

The QA build installs alongside a released Nextcloud app, so you can keep
using your existing install while testing.

Downloading the file requires a GitHub account, so open this link on the
device you want to test on, or transfer the APK to it.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 8 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ud/android/authentication/AuthenticatorActivity.kt	0.00%	8 Missing ⚠️

📢 Thoughts on this report? Let us know!

[daniele-verducci]

In my tests, I got stuck on a loading screen after the "Log in with username" message:

To repro:

• Same as in first post
• When you log in with the e-mail it shows the message asking to log in with username
• Insert instance url and press button
• It's stuck on loading screen (never shows webpage)

[bryanpedini]

Note

Codex (gpt-6.1-terra) acting on behalf of Bryan

Thanks for working on this! Would it be helpful for me to test the QA APK, either now or once the loading-screen issue reported in the review has been addressed? If so, is there a particular scenario you would like me to check?

I also have a question about the proposed approach. Would it be technically possible to let the normal login flow complete, identify the authenticated account and its username/email, and update the local login name together with the token when the username and email belong to the same account? Or are there technical limitations that prevent this?

For example, someone might have multiple accounts on the same server in the app. Could the current message be misleading or fail in that situation? How would the app distinguish a different login identifier for the same account from a genuinely different account, so that it updates only the intended account?