Task/learner 11425 freetier change

[srajupusapati]

Jira: https://2u-internal.atlassian.net/browse/LEARNER-11425

Updated the mobile_verify api domain "https://canvas.instructure.com/" to "https://sso.canvaslms.com/" as per instructure team suggestion and their repo

Reference: instructure/canvas-android@315c53f

[Copilot]

🟡 Changes recommended

There are confirmed cleanup issues in the diff (unused imports and an outdated in-code comment) that should be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the app’s login-related hostnames to follow Instructure’s OAuth domain migration from canvas.instructure.com to sso.canvaslms.com, and persists an additional region attribute returned from OAuth.

Changes:

• Replace hardcoded default Canvas/OAuth domains with sso.canvaslms.com in login, domain search, and related APIs.
• Expand WebView OAuth redirect parsing to support both new (/canvas/login?...) and legacy (/login/oauth2/auth?...) callback URLs.
• Store canvas_region from the OAuth token response into ApiPrefs.

File summaries

File	Description
libs/pandautils/src/main/java/com/instructure/pandautils/utils/Const.kt	Updates profile host constant to the new SSO domain.
libs/login-api-2/src/main/java/com/instructure/loginapi/login/api/MobileVerifyAPI.kt	Switches mobile verify base URL to the new SSO domain (non-beta path).
libs/login-api-2/src/main/java/com/instructure/loginapi/login/activities/BaseLoginSignInActivity.kt	Supports new/legacy OAuth redirect URLs; updates redirect_uri; persists canvasRegion.
libs/login-api-2/src/main/java/com/instructure/loginapi/login/activities/BaseLoginFindSchoolActivity.kt	Changes the default domain when user input is empty to the new SSO domain.
libs/canvas-api-2/src/main/java/com/instructure/canvasapi2/utils/ApiPrefs.kt	Adds a nullable preference for canvas_region.
libs/canvas-api-2/src/main/java/com/instructure/canvasapi2/models/OAuthToken.kt	Extends OAuth token response model to include canvas_region.
libs/canvas-api-2/src/main/java/com/instructure/canvasapi2/apis/ErrorReportAPI.kt	Updates the default error report domain to the new SSO domain.
libs/canvas-api-2/src/main/java/com/instructure/canvasapi2/apis/AccountDomainAPI.kt	Updates the default account domain search host to the new SSO domain.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[roy-sumanta]

Looks good.

[Copilot]

🔵 Needs a closer look

It changes authentication/redirect behavior and multiple default service domains, which should be validated with targeted manual/QA testing across login success/failure paths.

Review details

Suppressed comments (3)

Previously missed (2) — in code that hasn't changed since the last review.

libs/login-api-2/src/main/java/com/instructure/loginapi/login/activities/BaseLoginSignInActivity.kt:108

• The inline comment says the legacy success URL is needed for a “fallback redirect_uri”, but this class no longer builds a redirect_uri using /login/oauth2/auth (it uses urn:ietf:wg:oauth:2.0:oob or https://sso.canvaslms.com/canvas/login). This comment is misleading and makes it harder to reason about which redirects are actually supported.

This issue also appears on line 109 of the same file.
libs/login-api-2/src/main/java/com/instructure/loginapi/login/api/MobileVerifyAPI.kt:61

• The PR description says this updates only the mobile_verify API domain, but the diff also changes multiple other default/login domains (e.g., redirect_uri handling, AccountDomainAPI, ErrorReportAPI, PROFILE_URL) and adds persistence for canvas_region. Please update the PR description (or add notes in the commit/PR) to reflect the full scope and confirm these broader changes are intended for LEARNER-11425.

libs/login-api-2/src/main/java/com/instructure/loginapi/login/activities/BaseLoginSignInActivity.kt:112

• Similar to SUCCESS_URL_COLLECTION, the inline comment references a “fallback redirect_uri” for the legacy error URL, but this class doesn’t build a redirect_uri using /login/oauth2/auth anymore. Updating the comment avoids confusion about what redirect URIs are expected.

        val ERROR_URL_COLLECTION = listOf(
            "/canvas/login?error=access_denied", //error url
            "/login/oauth2/auth?error=access_denied" //legacy error url (needed for the fallback redirect_uri)
        )

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Lite