docs(runbook): diagnose Google OAuth 403 org_internal and document protected remediation by groupthinking · Pull Request #1064 · groupthinking/EventRelay

groupthinking · 2026-07-28T13:44:50Z

Canonical issue

Progresses #900 (does not close it — protected human steps remain). Canonical implementation PR for env-var precedence remains #903; this PR does not compete with it.

Outcome

Operators get a runbook diagnosis of the active production blocker — Google sign-in failing with Error 403: org_internal — plus the exact human-owned remediation (Google Cloud Console consent screen: switch Audience/User type from Internal to External, then publish or add test users), the externally verified state of the production authorize flow, and the OAuth error fingerprints to watch.

Scope

Included: docs/deployment/VERCEL_PRODUCTION_RUNBOOK.md only.
Explicitly excluded: any change to apps/web/src/lib/auth.ts, login pages, or env examples (owned by canonical PR fix(auth): restore Google OAuth configuration in Vercel production #903); any Google Cloud / Vercel configuration change (protected).

Risk

Risk level: low (documentation only)
Failure mode: none at runtime
Rollback: revert the commit

Verification

Live probe of https://uvai.io/login (2026-07-28, no credentials): the Google button redirects to Google's authorize endpoint with redirect_uri=https://uvai.io/api/auth/callback/google (exact canonical URI), scope=openid email profile, PKCE S256, and state — no redirect_uri_mismatch/invalid_client at this step.
Focused tests — n/a (docs only)
Required CI on this head
Review threads resolved — none yet

Production evidence

org_internal is emitted by Google's authorization server based on the OAuth client's consent-screen audience; it cannot be fixed or fully verified from repository code, and Google blocks non-interactive browsers before password entry. A real sign-in/callback after the console change remains a protected human step (documented in the runbook section).

Agent handoff

One canonical issue is linked
No competing PR implements the same issue
Acceptance criteria are satisfied (production OAuth verification remains human-owned)
Required checks pass on the current head
Human decision is requested only for product, security, irreversible infrastructure, or production approval

Agent provenance

…ument protected remediation Google sign-in at uvai.io fails with Error 403: org_internal for consumer accounts because the OAuth client's consent screen User type is Internal in Google Cloud Console. Document the root cause, the human-owned remediation (switch Audience to External and publish or add test users), the externally verified state of the production authorize flow (canonical redirect_uri, PKCE, state all correct), and the OAuth error fingerprints to watch. Generated with [Linear](https://linear.app/myxstack/issue/GRV-88/execution-verify-google-oauth-in-vercel-production-pr-903#agent-session-05438499) Co-authored-by: linear-code[bot] <222613912+linear-code[bot]@users.noreply.github.com>

linear-code · 2026-07-28T13:44:55Z

GRV-88

vercel · 2026-07-28T13:44:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled	Open in v0	Jul 28, 2026 1:44pm

coderabbitai · 2026-07-28T13:45:00Z

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

[‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: bf814f87-dbbf-4663-b57d-d991dcad1450

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch execution-verify-google-oauth-in-vercel-production-pr-grv-88-95ec

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch execution-verify-google-oauth-in-vercel-production-pr-grv-88-95ec

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-28T13:45:05Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA cade31d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

github-actions · 2026-07-28T13:45:24Z

Agent Completion Truth Gate: BLOCKED

Reasons: evidence_collection_failed, missing_declared_files, missing_agent_result, missing_copilot_current_head_review, missing_copilot_rabbit_label, required_checks_failed, draft_pr

Machine-readable verdict

{
  "details": {
    "collection_errors": [
      "incomplete_linked_issue_contract",
      "missing_closing_issue_reference",
      "missing_intent_snapshot",
      "agent_run_id_mismatch",
      "agent_login_mismatch"
    ],
    "identity_projection": {
      "agent_login": "google-labs-jules[bot]",
      "issue_number": 900,
      "run_id": "15243187445261469621"
    },
    "missing_declared_files": [
      ".env.example",
      "apps/web/.env.example",
      "apps/web/src/app/login/GoogleSignInButton.tsx",
      "apps/web/src/app/login/page.tsx",
      "apps/web/src/lib/__tests__/auth-config-source.test.ts",
      "apps/web/src/lib/auth.ts"
    ]
  },
  "reasons": [
    "evidence_collection_failed",
    "missing_declared_files",
    "missing_agent_result",
    "missing_copilot_current_head_review",
    "missing_copilot_rabbit_label",
    "required_checks_failed",
    "draft_pr"
  ],
  "verdict": "blocked"
}

Workflow evidence

groupthinking · 2026-07-28T14:10:09Z

Execution-controller reconciliation — 2026-07-28T14:05Z

This PR is retained as draft evidence only and receives no active-execution or #898 delivery credit.

Focused child Execution: verify Google OAuth in Vercel production (PR #903) #900 already has canonical implementation PR fix(auth): restore Google OAuth configuration in Vercel production #903 and canonical branch jules-15243187445261469621-ffdb089e.
This one-file runbook change is useful operational evidence, but binding a second PR to Execution: verify Google OAuth in Vercel production (PR #903) #900 violates the one-child/one-canonical-PR control.
Exact head: cade31dab9b3f13f4d5176043ffd8d2ac7e0d0a5.
Exact-head CI, CodeQL, Security, Secret Scan, and Dependency Review pass; E2E is repository-skipped; zero review threads exist.
Truth gate remains correctly blocked; Preview is canceled. Keep draft and duplicate.

The newly proven protected action remains: a Google Cloud owner must change the production OAuth consent-screen audience from Internal to External, then publish the app or add intended test users and complete a real sign-in/callback.

Execution receipt:

Agent login: groupthinking
Run ID: eventrelay-blocker-watch-20260728T1405Z
Canonical issue/branch/PR: Execution: verify Google OAuth in Vercel production (PR #903) #900 / jules-15243187445261469621-ffdb089e / fix(auth): restore Google OAuth configuration in Vercel production #903
Reconciled evidence PR: docs(runbook): diagnose Google OAuth 403 org_internal and document protected remediation #1064
Claimed: 2026-07-28T14:05:35Z
Latest heartbeat: 2026-07-28T14:08:00Z
Exact evidence head: cade31dab9b3f13f4d5176043ffd8d2ac7e0d0a5

groupthinking · 2026-08-05T00:50:32Z

Closing — branch orphaned by the secret-purge force-push

No common ancestor with current main, so this branch is not rebaseable.

This is documentation — the Google OAuth 403 org_internal diagnosis and remediation runbook. Worth re-cutting alongside #903, which carries the actual OAuth configuration fix. Tracked in #1378.

Branch retained for archive-tagging.

Generated by Claude Code

github-actions Bot added the documentation Improvements or additions to documentation label Jul 28, 2026

groupthinking added the duplicate This issue or pull request already exists label Jul 28, 2026 — with ChatGPT Codex Connector

This was referenced Jul 28, 2026

Execution: verify Google OAuth in Vercel production (PR #903) #900

Open

[PROGRAM][OWNER:Codex] Autonomous EventRelay delivery control plane #898

Open

This was referenced Aug 5, 2026

Re-cut work orphaned by the secret-purge force-push (26 PRs) #1378

Open

fix(auth): restore Google OAuth configuration in Vercel production #903

Open

groupthinking closed this Aug 5, 2026

groupthinking added ci-refresh and removed ci-refresh labels Aug 5, 2026

Navigation Menu

docs(runbook): diagnose Google OAuth 403 org_internal and document protected remediation - #1064

docs(runbook): diagnose Google OAuth 403 org_internal and document protected remediation#1064
groupthinking wants to merge 1 commit into
mainfrom
execution-verify-google-oauth-in-vercel-production-pr-grv-88-95ec

groupthinking commented Jul 28, 2026 •

edited

Loading

Uh oh!

linear-code Bot commented Jul 28, 2026

Uh oh!

vercel Bot commented Jul 28, 2026

Uh oh!

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

groupthinking commented Jul 28, 2026

Uh oh!

groupthinking commented Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

groupthinking commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Canonical issue

Outcome

Scope

Risk

Verification

Production evidence

Agent handoff

Agent provenance

Uh oh!

linear-code Bot commented Jul 28, 2026

Uh oh!

vercel Bot commented Jul 28, 2026

Uh oh!

coderabbitai Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Jul 28, 2026

Dependency Review

Snapshot Warnings

Scanned Files

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Agent Completion Truth Gate: BLOCKED

Uh oh!

groupthinking commented Jul 28, 2026

Uh oh!

groupthinking commented Aug 5, 2026

Closing — branch orphaned by the secret-purge force-push

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

groupthinking commented Jul 28, 2026 •

edited

Loading

coderabbitai Bot commented Jul 28, 2026 •

edited

Loading

github-actions Bot commented Jul 28, 2026 •

edited

Loading