Why do I need to select an on-device account?

FAQ.md

@@ -3399,6 +3399,7 @@ OAuth for Gmail is supported via the quick setup wizard.
 The Android account manager will be used to fetch and refresh OAuth tokens for selected on-device accounts.
 OAuth for non on-device accounts is not supported
 because Google requires a [yearly security audit](https://support.google.com/cloud/answer/9110914) ($15,000 to $75,000) for this.
+Since FairEmail is basically offered free of charge, it is not an option to pay such an amount annually for a security audit.
 You can read more about this [here](https://www.theregister.com/2019/02/11/google_gmail_developer/).
 
 OAuth for Outlook/Office 365, Yahoo, Mail.ru and Yandex is supported via the quick setup wizard.

app/src/main/java/eu/faircode/email/FragmentGmail.java

@@ -86,6 +86,7 @@ public class FragmentGmail extends FragmentBase {
     private Button btnSelect;
     private ContentLoadingProgressBar pbSelect;
 
+    private TextView tvOnDevice;
     private TextView tvAppPassword;
 
     private TextView tvError;
@@ -129,6 +130,7 @@ public class FragmentGmail extends FragmentBase {
         btnSelect = view.findViewById(R.id.btnSelect);
         pbSelect = view.findViewById(R.id.pbSelect);
 
+        tvOnDevice = view.findViewById(R.id.tvOnDevice);
         tvAppPassword = view.findViewById(R.id.tvAppPassword);
 
         tvError = view.findViewById(R.id.tvError);
@@ -200,6 +202,14 @@ public class FragmentGmail extends FragmentBase {
             }
         });
 
+        tvOnDevice.setPaintFlags(tvOnDevice.getPaintFlags() | Paint.UNDERLINE_TEXT_FLAG);
+        tvOnDevice.setOnClickListener(new View.OnClickListener() {
+            @Override
+            public void onClick(View v) {
+                Helper.viewFAQ(v.getContext(), 111);
+            }
+        });
+
         tvAppPassword.setPaintFlags(tvAppPassword.getPaintFlags() | Paint.UNDERLINE_TEXT_FLAG);
         tvAppPassword.setOnClickListener(new View.OnClickListener() {
             @Override

app/src/main/res/layout/fragment_gmail.xml

@@ -154,9 +154,24 @@
             app:layout_constraintStart_toStartOf="parent"
             app:layout_constraintTop_toBottomOf="@id/btnSelect" />
 
+        <TextView
+            android:id="@+id/tvOnDevice"
+            android:layout_width="0dp"
+            android:layout_height="wrap_content"
+            android:layout_marginTop="12dp"
+            android:drawableEnd="@drawable/twotone_open_in_new_24"
+            android:drawablePadding="6dp"
+            android:drawableTint="?android:attr/textColorLink"
+            android:text="@string/title_setup_gmail_on_device"
+            android:textAppearance="@style/TextAppearance.AppCompat.Small"
+            android:textColor="?android:attr/textColorLink"
+            app:layout_constraintEnd_toEndOf="parent"
+            app:layout_constraintStart_toStartOf="parent"
+            app:layout_constraintTop_toBottomOf="@id/tvSelectHint" />
+
         <TextView
             android:id="@+id/tvAppPassword"
-            android:layout_width="wrap_content"
+            android:layout_width="0dp"
             android:layout_height="wrap_content"
             android:layout_marginTop="12dp"
             android:drawableEnd="@drawable/twotone_open_in_new_24"
@@ -165,8 +180,9 @@
             android:text="@string/title_setup_gmail_password"
             android:textAppearance="@style/TextAppearance.AppCompat.Small"
             android:textColor="?android:attr/textColorLink"
+            app:layout_constraintEnd_toEndOf="parent"
             app:layout_constraintStart_toStartOf="parent"
-            app:layout_constraintTop_toBottomOf="@id/tvSelectHint" />
+            app:layout_constraintTop_toBottomOf="@id/tvOnDevice" />
 
         <TextView
             android:id="@+id/tvErrorTitle"

app/src/main/res/values/strings.xml

@@ -211,6 +211,7 @@
     <string name="title_setup_gmail_support">Authorizing Google accounts will work in the Play Store and GitHub version only because Android checks the digital app signature</string>
     <string name="title_setup_gmail_rationale">Please grant permissions to select an account and read your name</string>
     <string name="title_setup_gmail_permissions">Google will ask for permissions to read, compose, send and permanently delete all your email. FairEmail will never delete your messages without your explicit consent.</string>
+    <string name="title_setup_gmail_on_device">Why do I need to select an on-device account?</string>
     <string name="title_setup_gmail_password">I want to authorize an account with a password instead of an on-device account</string>
     <string name="title_setup_office_auth">The error \'AUTHENTICATE failed\' can be caused by IMAP/SMTP being disabled by the system administrator</string>
     <string name="title_setup_oauth_rationale">Authorize access to your %1$s account</string>