Host `/.well-known/assetlinks.json` — App Links verification currently fails for every https deep link

[Adron]

Found while implementing #89. Pre-existing, and it silently disables a feature that already
shipped.

The problem

https://interlinedlist.com/.well-known/assetlinks.json returns 404 (verified).

app/src/main/AndroidManifest.xml declares an autoVerify="true" intent filter covering:

• /lists/shared/… and /documents/shared/… (share links)
• /reset-password
• /verify-email
• /verify-email-change, /undo-email-change (Account: complete the email-change flow (verify and undo) #72)
• / (the tag feed, Tags: tag-filtered feed (GET /api/messages?tag=) #29)
• /api/blog/subscribe/confirm, /api/blog/unsubscribe (Blog: subscribe and unsubscribe from post emails #89)

Android App Links verification requires the site to host a Digital Asset Links file naming the
app's package and signing-certificate fingerprints. Without it, verification fails, and on
Android 12+ the system will not auto-open the app for any of those URLs — the user gets a
browser, or at best a disambiguation dialog they have to opt into via Settings → Default apps →
Opening links.

So every https:// deep link the app has shipped so far is effectively inert on modern Android.
The interlinedlist:// custom-scheme equivalents work regardless, which is why this has not been
noticed.

The fix (server side)

Host at https://interlinedlist.com/.well-known/assetlinks.json, served as
application/json over HTTPS with no redirect:

[{
  "relation": ["delegate_permission/common.handle_all_urls"],
  "target": {
    "namespace": "android_app",
    "package_name": "com.interlinedlist.android",
    "sha256_cert_fingerprints": [
      "<debug keystore SHA-256>",
      "<release keystore SHA-256>",
      "<Play App Signing SHA-256, if Play re-signs>"
    ]
  }
}]

All three fingerprints matter. If Play App Signing is enabled, the certificate users actually
get is Play's, not the upload key — omitting it means verification passes in testing and fails in
production.

Confirm the package_name against the release applicationId (the debug build uses a .debug
suffix, which needs its own entry or its own file if both are to verify).

Verifying afterwards

• adb shell pm get-app-links com.interlinedlist.android should report verified per host.
• Google's checker: https://digitalassetlinks.googleapis.com/v1/statements:list?source.web.site=https://interlinedlist.com&relation=delegate_permission/common.handle_all_urls

Related

• OAuth: link a social account from Android via Custom Tabs #39 (OAuth) offers an App Link redirect as its preferred option — that option depends
  entirely on this file existing.
• Tags: tag-filtered feed (GET /api/messages?tag=) #29 notes the / filter claims plain homepage links; that decision is worth revisiting at the
  same time.