fix(auth): restore Google OAuth configuration in Vercel production

[google-labs-jules]

Canonical issue

Closes #900

Outcome

Makes GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET the canonical Google OAuth variables while retaining GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET as temporary backward-compatible fallbacks. This removes the unsafe deployment-ordering constraint without breaking production environments that still rely on the legacy names.

Scope

• Included:
  • prefer standard Google OAuth env names in apps/web/src/lib/auth.ts
  • keep legacy OAuth env names as temporary fallback
  • add source-level precedence assertions in apps/web/src/lib/__tests__/auth-config-source.test.ts
  • add the login-page Google sign-in button used by apps/web/src/app/login/page.tsx
  • update .env.example, apps/web/.env.example, and the Vercel production runbook to document the migration and fallback-removal gate
• Explicitly excluded:
  • any production credential mutation
  • redirect URI changes in Google Cloud
  • production deploy and sign-in verification

Risk

• Risk level: low
• Failure mode: if the canonical env vars are absent in production, the app would still continue to rely on the legacy fallback names until the migration is completed
• Rollback: revert this PR or restore the previous env lookup ordering in apps/web/src/lib/auth.ts

Verification

List exact automated and manual checks, tied to the current head SHA.

• Focused tests: npm --prefix apps/web test -- --run src/lib/__tests__/auth-config-source.test.ts
• Required CI
• Review threads resolved

Production evidence

Not yet applicable from this branch alone. Protected production verification remains on #900: confirm Vercel production has GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, verify the redirect URI is exactly https://uvai.io/api/auth/callback/google, deploy merged main, then complete a real Google sign-in and callback.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied for the code-side migration only; protected production verification remains open on Execution: verify Google OAuth in Vercel production (PR #903) #900
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

Agent provenance

The declared agent publishes a result comment on the linked issue or PR with the exact run ID and current 40-character head SHA.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled		Aug 29, 2026 7:47am

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (20090 lines changed)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 57ff988.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: evidence_collection_failed, missing_agent_result, missing_copilot_current_head_review, required_checks_failed, draft_pr, missing_test_evidence

Machine-readable verdict

{
  "details": {
    "collection_errors": [
      "incomplete_linked_issue_contract",
      "missing_intent_snapshot"
    ],
    "identity_projection": {
      "agent_login": "google-labs-jules[bot]",
      "issue_number": 900,
      "run_id": "15243187445261469621"
    }
  },
  "reasons": [
    "evidence_collection_failed",
    "missing_agent_result",
    "missing_copilot_current_head_review",
    "required_checks_failed",
    "draft_pr",
    "missing_test_evidence"
  ],
  "verdict": "blocked"
}

Workflow evidence

[groupthinking]

Review — standardizing on GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET

The direction is reasonable (one canonical env-var name), and the docs/tests are updated consistently. But there are two things to confirm before this merges/deploys, because as written it can keep OAuth broken rather than restore it.

1. Deploy-ordering hazard — removing the legacy fallback is a one-way narrowing ⚠️

apps/web/src/lib/auth.ts previously read GOOGLE_OAUTH_CLIENT_ID || GOOGLE_CLIENT_ID. This PR drops the GOOGLE_OAUTH_CLIENT_ID branch:

const googleClientId = ( process.env.GOOGLE_CLIENT_ID || '' ).trim();

If the Vercel v0-uvai production env currently holds the credentials under the legacy GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET names (which is what the old docs listed as canonical), deploying this will make the code stop reading them → client_id is required continues. The safe sequence is:

1. Set GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET in Vercel production first and verify /api/auth/providers returns Google.
2. Then merge/deploy this code.

Please confirm the Vercel env state before merge. (Keeping both fallbacks would remove the ordering constraint entirely — worth considering if the goal is purely to un-break prod quickly, since the fallback costs nothing.)

2. This is a code-only change — it does not by itself close #900

#900 is an environment-configuration incident; the fix lives in the Vercel dashboard, not the repo. The runbook addition here correctly documents the manual step, but the checklist items in #900 (creds present in Vercel, redeploy from main, real sign-in + 24h clean logs, attach deploy SHA) still need to be executed and evidenced. Merging this PR alone will not satisfy the acceptance criteria.

3. Duplicate of #902

#902 (Codex) has the same title and also targets #900. One should be chosen and the other closed to avoid divergent OAuth config landing twice.

CI note (not a defect in this PR)

The red check is agent-completion/truth-gate, blocked with invalid_payload on invalid_fields: ["policy.agent_login","policy.run_id"] — i.e. the gate workflow's own payload plumbing, failing repo-wide across all open PRs, not anything in this diff.

Recommendation: hold merge until (1) the Vercel env vars are confirmed set under the new names and (2) #902-vs-#903 is decided. Not approving/merging autonomously — main is protected and this needs the env-state confirmation above.

---

Generated by Claude Code

[groupthinking]

This is now the canonical implementation PR for #900; #902 is superseded. Code/security checks pass on exact head 7ff692d5137297485f5e116d46ef1cc1e58cff82 and no active review threads were found. The remaining boundary is human-owned production credential/callback verification. Keep this draft until review confirms the naming migration and an authorized owner can complete the protected Vercel/Google configuration steps without exposing secrets.

[Copilot]

Copilot wasn't able to review any files in this pull request.

[groupthinking]

Blocker watch restored this PR to draft at exact head 4b71e1f290d59272b0ba9c917130edfbcdcbc2e8.

The repository checks pass, but readiness is not yet safe:

• the code removes GOOGLE_OAUTH_CLIENT_ID / GOOGLE_OAUTH_CLIENT_SECRET fallback before the production environment is confirmed migrated;
• deploying in that order can preserve or recreate the existing client_id is required outage;
• the exact-head Vercel preview dpl_8UwEcdD3zb9yxW2jdp2DyootWWeF was canceled;
• production credential, callback, real sign-in, and 24-hour clean-runtime evidence are still missing.

@jules keep the legacy names as temporary fallback while making GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET canonical, extend tests for canonical precedence plus legacy compatibility, and document the removal gate. Then request review on the new exact head. The fallback should be removed only after production migration evidence is attached to #900.

[groupthinking]

Closing — branch orphaned by the secret-purge force-push

git merge-base origin/main <this branch> is empty — no shared ancestry with current main. This branch has been open since Jul 20 and carries a merge: synchronize canonical #903 with verified main commit, but that merge did not establish real ancestry; the histories remain unrelated.

The work is unlanded and still wanted — restoring Google OAuth configuration in Vercel production. The Jul 27 and Aug 1 control logs both record this as blocked on protected OAuth/sign-in evidence that requires human access, so re-cutting it will still need that step.

Tracked in #1378, alongside #1064 which documents the org_internal 403 diagnosis. Branch retained for archive-tagging.

---

Generated by Claude Code

[github-actions]

⚠️ Repository reconciliation: this PR does not reference exactly one canonical issue.

Please add a Closes #<issue> reference in the PR description so it can be tracked against the delivery plan.

See governance: #898