apps/api/src/routes/auth.ts

import { Elysia } from 'elysia';
import type { AuthRequest, RegisterRequest } from '@zeavis/shared';
import { eq } from 'drizzle-orm';
import { createDbClient } from '../db/client';
import { users } from '../db/schema';
import { badRequest, serviceUnavailable } from '../lib/http-errors';
import {
  clearSessionCookie,
  createSession,
  createSessionCookie,
  deleteSession,
  getAuthFeatures,
  getCurrentUser,
  hashPassword,
  readSessionToken,
  verifyPassword,
} from '../lib/auth';
import { env } from '../config/env';
import { authCounter } from '../lib/telemetry';

// ── Google OAuth Helpers ──────────────────────────────────────────────

interface GoogleTokenResponse {
  access_token: string;
  id_token: string;
}

interface GoogleIdPayload {
  sub: string;
  email: string;
  email_verified: boolean;
  name: string;
  picture?: string;
}

async function exchangeGoogleCode(code: string): Promise<GoogleTokenResponse> {
  const res = await fetch('https://oauth2.googleapis.com/token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      code,
      client_id: env.googleClientId!,
      client_secret: env.googleClientSecret!,
      redirect_uri: env.googleRedirectUri!,
      grant_type: 'authorization_code',
    }),
  });

  if (!res.ok) {
    const err = await res.text();
    throw new Error(`Google token exchange failed: ${res.status} ${err}`);
  }

  return res.json() as Promise<GoogleTokenResponse>;
}

function decodeGoogleIdToken(idToken: string): GoogleIdPayload {
  const parts = idToken.split('.');
  if (parts.length !== 3) {
    throw new Error('Invalid id_token format');
  }
  const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');
  return JSON.parse(payload);
}

/**
 * Render a page for the Android system browser that redirects back to the
 * Tauri app via a custom scheme (zeavisedu://). The app's AndroidManifest
 * must register an intent filter for this scheme.
 */
function renderTauriDeepLinkPage(targetUrl: string): Response {
  // Rewrite https://... to zeavisedu://... for the custom scheme
  const deepLink = targetUrl.replace(/^https?:\/\//, 'zeavisedu://');
  const html = `<!DOCTYPE html>
<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>Kembali ke ZeaVis Edu</title></head>
<body style="font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f0fdf4">
<div style="text-align:center;padding:2rem">
<p style="color:#166534;font-size:1.1rem;margin-bottom:1.5rem">Login berhasil!<br>Kembali ke aplikasi...</p>
<a href="${deepLink.replace(/"/g, '&quot;')}" style="display:inline-block;background:#16a34a;color:white;padding:0.75rem 2rem;border-radius:0.5rem;text-decoration:none;font-weight:600;font-size:1rem">Buka ZeaVis Edu</a>
<p style="color:#6b7280;font-size:0.8rem;margin-top:1rem">Jika tombol tidak berfungsi, salin URL ini:<br><code style="word-break:break-all;font-size:0.75rem">${deepLink.replace(/</g, '&lt;')}</code></p>
</div>
<script>window.location.href=${JSON.stringify(deepLink)};</script>
</body></html>`;
  return new Response(html, {
    status: 200,
    headers: { 'Content-Type': 'text/html;charset=utf-8' },
  });
}

function resolvePlatform(stateRaw: string | undefined): string {
  try {
    if (stateRaw) {
      const parsed = JSON.parse(Buffer.from(stateRaw, 'base64url').toString('utf-8'));
      return parsed.platform ?? 'web';
    }
  } catch { /* ignore */ }
  return 'web';
}

function normalizeEmail(email: unknown) {
  return typeof email === 'string' ? email.trim().toLowerCase() : '';
}

function normalizeName(name: unknown) {
  return typeof name === 'string' ? name.trim() : '';
}

function validatePassword(password: unknown) {
  return typeof password === 'string' && password.length >= 8;
}

export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
  .get('/me', async ({ request }) => {
    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
    return {
      user,
      features: getAuthFeatures(),
    };
  })
  .post('/register', async ({ body, set, request }) => {
    const req = body as Partial<RegisterRequest> | undefined;
    const email = normalizeEmail(req?.email);
    const name = normalizeName(req?.name);

    if (!email || !email.includes('@') || !name || !validatePassword(req?.password)) {
      return badRequest('Name, valid email, and password with at least 8 characters are required');
    }

    try {
      const db = createDbClient();
      const existing = await db.select().from(users).where(eq(users.email, email)).limit(1);
      if (existing.length > 0) {
        return badRequest('Email is already registered');
      }

      const passwordHash = await hashPassword(req!.password!);
      const inserted = await db
        .insert(users)
        .values({ email, name, passwordHash, role: 'user' })
        .returning();

      const user = inserted[0];
      const token = await createSession(user.id);
      set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);

      authCounter.labels('register', 'true').inc();

      return {
        user: {
          id: user.id,
          email: user.email,
          name: user.name,
          role: 'user' as const,
        },
        token,
        features: getAuthFeatures(),
      };
    } catch (error) {
      return serviceUnavailable('Database unavailable');
    }
  })
  .post('/login', async ({ body, set, request }) => {
    const req = body as Partial<AuthRequest> | undefined;
    const email = normalizeEmail(req?.email);

    if (!email || !validatePassword(req?.password)) {
      return badRequest('Valid email and password are required');
    }

    try {
      const db = createDbClient();
      const rows = await db.select().from(users).where(eq(users.email, email)).limit(1);
      const user = rows[0];

      if (!user?.passwordHash || !(await verifyPassword(req!.password!, user.passwordHash))) {
        authCounter.labels('login', 'false').inc();
        return badRequest('Invalid email or password');
      }

      const token = await createSession(user.id);
      set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);

      authCounter.labels('login', 'true').inc();

      return {
        user: {
          id: user.id,
          email: user.email,
          name: user.name,
          role: user.role === 'expert' ? 'expert' as const : 'user' as const,
        },
        token,
        features: getAuthFeatures(),
      };
    } catch (error) {
      return serviceUnavailable('Database unavailable');
    }
  })
  .post('/logout', async ({ request, set }) => {
    const cookieHeader = request.headers.get('cookie');
    await deleteSession(readSessionToken(cookieHeader));
    set.headers['Set-Cookie'] = clearSessionCookie(request.headers);
    return { ok: true };
  })
  .get('/google', ({ query, set }) => {
    if (!env.googleOAuthEnabled) {
      set.status = 404;
      return { error: 'Google OAuth is not configured' };
    }

    const platform = (query as Record<string, string>).platform ?? 'web';
    const state = Buffer.from(JSON.stringify({ platform })).toString('base64url');

    const params = new URLSearchParams({
      client_id: env.googleClientId!,
      redirect_uri: env.googleRedirectUri!,
      response_type: 'code',
      scope: 'openid email profile',
      access_type: 'offline',
      prompt: 'select_account',
      state,
    });

    set.status = 302;
    set.headers['Location'] = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
  })
  .get('/google/callback', async ({ query, set, request }) => {
    if (!env.googleOAuthEnabled) {
      set.status = 404;
      return { error: 'Google OAuth is not configured' };
    }

    const q = query as Record<string, string>;
    const code = q.code;
    const error = q.error;
    const platform = resolvePlatform(q.state);

    // User denied or Google returned an error
    const makeErrorUrl = (msg: string) =>
      `${env.webAppUrl}/login?error=${encodeURIComponent(msg)}`;

    if (error || !code) {
      const url = makeErrorUrl(error ?? 'missing_code');
      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
      set.status = 302;
      set.headers['Location'] = url;
      return;
    }

    // Exchange authorization code for tokens
    let idPayload: GoogleIdPayload;
    try {
      const tokens = await exchangeGoogleCode(code);
      idPayload = decodeGoogleIdToken(tokens.id_token);
    } catch (err) {
      const msg = err instanceof Error ? err.message : 'Google auth failed';
      const url = makeErrorUrl(msg);
      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
      set.status = 302;
      set.headers['Location'] = url;
      return;
    }

    // Validate email
    if (!idPayload.email_verified || !idPayload.email) {
      const url = makeErrorUrl('Email not verified by Google');
      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
      set.status = 302;
      set.headers['Location'] = url;
      return;
    }

    const googleId = idPayload.sub;
    const email = idPayload.email.trim().toLowerCase();
    const name = idPayload.name?.trim() ?? email.split('@')[0];

    try {
      const db = createDbClient();

      let user = await db.select().from(users).where(eq(users.googleId, googleId)).limit(1).then(r => r[0] ?? null);

      if (!user) {
        user = await db.select().from(users).where(eq(users.email, email)).limit(1).then(r => r[0] ?? null);
        if (user) {
          await db.update(users).set({ googleId }).where(eq(users.id, user.id));
        }
      }

      if (!user) {
        const inserted = await db
          .insert(users)
          .values({ email, name, googleId, role: 'user' })
          .returning();
        user = inserted[0];
        authCounter.labels('register', 'true').inc();
      }

      const token = await createSession(user.id);
      set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);

      authCounter.labels('login', 'true').inc();

      const successUrl = `${env.webAppUrl}/login?token=${encodeURIComponent(token)}`;
      if (platform === 'tauri') return renderTauriDeepLinkPage(successUrl);
      set.status = 302;
      set.headers['Location'] = successUrl;
    } catch (err) {
      const url = makeErrorUrl('Database unavailable');
      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
      set.status = 302;
      set.headers['Location'] = url;
    }
  });
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`import { Elysia } from 'elysia';`
			`import type { AuthRequest, RegisterRequest } from '@zeavis/shared';`
			`import { eq } from 'drizzle-orm';`
			`import { createDbClient } from '../db/client';`
			`import { users } from '../db/schema';`
			`import { badRequest, serviceUnavailable } from '../lib/http-errors';`
			`import {`
			`clearSessionCookie,`
			`createSession,`
			`createSessionCookie,`
			`deleteSession,`
			`getAuthFeatures,`
			`getCurrentUser,`
			`hashPassword,`
			`readSessionToken,`
			`verifyPassword,`
			`} from '../lib/auth';`
			`import { env } from '../config/env';`
feat(api): add Prometheus metrics and OpenTelemetry instrumentation for HTTP, auth, classifications, and diagnoses 2026-06-07 18:01:26 +07:00			`import { authCounter } from '../lib/telemetry';`
feat: add session auth routes 2026-05-22 15:53:48 +00:00
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`// ── Google OAuth Helpers ──────────────────────────────────────────────`

			`interface GoogleTokenResponse {`
			`access_token: string;`
			`id_token: string;`
			`}`

			`interface GoogleIdPayload {`
			`sub: string;`
			`email: string;`
			`email_verified: boolean;`
			`name: string;`
			`picture?: string;`
			`}`

			`async function exchangeGoogleCode(code: string): Promise<GoogleTokenResponse> {`
			`const res = await fetch('https://oauth2.googleapis.com/token', {`
			`method: 'POST',`
			`headers: { 'Content-Type': 'application/x-www-form-urlencoded' },`
			`body: new URLSearchParams({`
			`code,`
			`client_id: env.googleClientId!,`
			`client_secret: env.googleClientSecret!,`
			`redirect_uri: env.googleRedirectUri!,`
			`grant_type: 'authorization_code',`
			`}),`
			`});`

			`if (!res.ok) {`
			`const err = await res.text();`
			throw new Error(`Google token exchange failed: ${res.status} ${err}`);
			`}`

			`return res.json() as Promise<GoogleTokenResponse>;`
			`}`

			`function decodeGoogleIdToken(idToken: string): GoogleIdPayload {`
			`const parts = idToken.split('.');`
			`if (parts.length !== 3) {`
			`throw new Error('Invalid id_token format');`
			`}`
			`const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');`
			`return JSON.parse(payload);`
			`}`

feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`/**`
			`* Render a page for the Android system browser that redirects back to the`
			`* Tauri app via a custom scheme (zeavisedu://). The app's AndroidManifest`
			`* must register an intent filter for this scheme.`
			`*/`
			`function renderTauriDeepLinkPage(targetUrl: string): Response {`
			`// Rewrite https://... to zeavisedu://... for the custom scheme`
			`const deepLink = targetUrl.replace(/^https?:\/\//, 'zeavisedu://');`
			const html = `<!DOCTYPE html>
			`<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">`
			`<title>Kembali ke ZeaVis Edu</title></head>`
			`<body style="font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f0fdf4">`
			`<div style="text-align:center;padding:2rem">`
			`<p style="color:#166534;font-size:1.1rem;margin-bottom:1.5rem">Login berhasil!<br>Kembali ke aplikasi...</p>`
			`<a href="${deepLink.replace(/"/g, '"')}" style="display:inline-block;background:#16a34a;color:white;padding:0.75rem 2rem;border-radius:0.5rem;text-decoration:none;font-weight:600;font-size:1rem">Buka ZeaVis Edu</a>`
			`<p style="color:#6b7280;font-size:0.8rem;margin-top:1rem">Jika tombol tidak berfungsi, salin URL ini:<br><code style="word-break:break-all;font-size:0.75rem">${deepLink.replace(/</g, '<')}</code></p>`
			`</div>`
			`<script>window.location.href=${JSON.stringify(deepLink)};</script>`
			</body></html>`;
			`return new Response(html, {`
			`status: 200,`
			`headers: { 'Content-Type': 'text/html;charset=utf-8' },`
			`});`
			`}`

			`function resolvePlatform(stateRaw: string \| undefined): string {`
			`try {`
			`if (stateRaw) {`
			`const parsed = JSON.parse(Buffer.from(stateRaw, 'base64url').toString('utf-8'));`
			`return parsed.platform ?? 'web';`
			`}`
			`} catch { /* ignore */ }`
			`return 'web';`
			`}`

feat: add session auth routes 2026-05-22 15:53:48 +00:00			`function normalizeEmail(email: unknown) {`
			`return typeof email === 'string' ? email.trim().toLowerCase() : '';`
			`}`

			`function normalizeName(name: unknown) {`
			`return typeof name === 'string' ? name.trim() : '';`
			`}`

			`function validatePassword(password: unknown) {`
			`return typeof password === 'string' && password.length >= 8;`
			`}`

			`export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })`
			`.get('/me', async ({ request }) => {`
fix(auth): add bearer token auth as fallback for Android WebView third-party cookie blocking 2026-06-15 19:43:02 +07:00			`const user = await getCurrentUser(request.headers.get('cookie'), request.headers);`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`return {`
			`user,`
			`features: getAuthFeatures(),`
			`};`
			`})`
fix(auth): detect HTTPS via X-Forwarded-Proto for SameSite=None cookies, fix AuthGuard null overwrite 2026-06-15 18:17:26 +07:00			`.post('/register', async ({ body, set, request }) => {`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`const req = body as Partial<RegisterRequest> \| undefined;`
			`const email = normalizeEmail(req?.email);`
			`const name = normalizeName(req?.name);`

			`if (!email \|\| !email.includes('@') \|\| !name \|\| !validatePassword(req?.password)) {`
			`return badRequest('Name, valid email, and password with at least 8 characters are required');`
			`}`

			`try {`
			`const db = createDbClient();`
			`const existing = await db.select().from(users).where(eq(users.email, email)).limit(1);`
			`if (existing.length > 0) {`
			`return badRequest('Email is already registered');`
			`}`

			`const passwordHash = await hashPassword(req!.password!);`
			`const inserted = await db`
			`.insert(users)`
			`.values({ email, name, passwordHash, role: 'user' })`
			`.returning();`

			`const user = inserted[0];`
			`const token = await createSession(user.id);`
fix(auth): detect HTTPS via X-Forwarded-Proto for SameSite=None cookies, fix AuthGuard null overwrite 2026-06-15 18:17:26 +07:00			`set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);`
feat: add session auth routes 2026-05-22 15:53:48 +00:00
feat(api): add Prometheus metrics and OpenTelemetry instrumentation for HTTP, auth, classifications, and diagnoses 2026-06-07 18:01:26 +07:00			`authCounter.labels('register', 'true').inc();`

feat: add session auth routes 2026-05-22 15:53:48 +00:00			`return {`
			`user: {`
			`id: user.id,`
			`email: user.email,`
			`name: user.name,`
			`role: 'user' as const,`
			`},`
fix(auth): add bearer token auth as fallback for Android WebView third-party cookie blocking 2026-06-15 19:43:02 +07:00			`token,`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`features: getAuthFeatures(),`
			`};`
			`} catch (error) {`
			`return serviceUnavailable('Database unavailable');`
			`}`
			`})`
fix(auth): detect HTTPS via X-Forwarded-Proto for SameSite=None cookies, fix AuthGuard null overwrite 2026-06-15 18:17:26 +07:00			`.post('/login', async ({ body, set, request }) => {`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`const req = body as Partial<AuthRequest> \| undefined;`
			`const email = normalizeEmail(req?.email);`

			`if (!email \|\| !validatePassword(req?.password)) {`
			`return badRequest('Valid email and password are required');`
			`}`

			`try {`
			`const db = createDbClient();`
			`const rows = await db.select().from(users).where(eq(users.email, email)).limit(1);`
			`const user = rows[0];`

			`if (!user?.passwordHash \|\| !(await verifyPassword(req!.password!, user.passwordHash))) {`
feat(api): add Prometheus metrics and OpenTelemetry instrumentation for HTTP, auth, classifications, and diagnoses 2026-06-07 18:01:26 +07:00			`authCounter.labels('login', 'false').inc();`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`return badRequest('Invalid email or password');`
			`}`

			`const token = await createSession(user.id);`
fix(auth): detect HTTPS via X-Forwarded-Proto for SameSite=None cookies, fix AuthGuard null overwrite 2026-06-15 18:17:26 +07:00			`set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);`
feat: add session auth routes 2026-05-22 15:53:48 +00:00
feat(api): add Prometheus metrics and OpenTelemetry instrumentation for HTTP, auth, classifications, and diagnoses 2026-06-07 18:01:26 +07:00			`authCounter.labels('login', 'true').inc();`

feat: add session auth routes 2026-05-22 15:53:48 +00:00			`return {`
			`user: {`
			`id: user.id,`
			`email: user.email,`
			`name: user.name,`
			`role: user.role === 'expert' ? 'expert' as const : 'user' as const,`
			`},`
fix(auth): add bearer token auth as fallback for Android WebView third-party cookie blocking 2026-06-15 19:43:02 +07:00			`token,`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`features: getAuthFeatures(),`
			`};`
			`} catch (error) {`
			`return serviceUnavailable('Database unavailable');`
			`}`
			`})`
			`.post('/logout', async ({ request, set }) => {`
fix(auth): detect HTTPS via X-Forwarded-Proto for SameSite=None cookies, fix AuthGuard null overwrite 2026-06-15 18:17:26 +07:00			`const cookieHeader = request.headers.get('cookie');`
			`await deleteSession(readSessionToken(cookieHeader));`
			`set.headers['Set-Cookie'] = clearSessionCookie(request.headers);`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`return { ok: true };`
			`})`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`.get('/google', ({ query, set }) => {`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`if (!env.googleOAuthEnabled) {`
			`set.status = 404;`
			`return { error: 'Google OAuth is not configured' };`
			`}`

feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const platform = (query as Record<string, string>).platform ?? 'web';`
			`const state = Buffer.from(JSON.stringify({ platform })).toString('base64url');`

feat: add session auth routes 2026-05-22 15:53:48 +00:00			`const params = new URLSearchParams({`
			`client_id: env.googleClientId!,`
			`redirect_uri: env.googleRedirectUri!,`
			`response_type: 'code',`
			`scope: 'openid email profile',`
			`access_type: 'offline',`
			`prompt: 'select_account',`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`state,`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`});`

fix(auth): replace deprecated set.redirect with manual 302 Location header 2026-06-15 22:06:59 +07:00			`set.status = 302;`
			set.headers['Location'] = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`})`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`.get('/google/callback', async ({ query, set, request }) => {`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`if (!env.googleOAuthEnabled) {`
			`set.status = 404;`
			`return { error: 'Google OAuth is not configured' };`
			`}`

feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const q = query as Record<string, string>;`
			`const code = q.code;`
			`const error = q.error;`
			`const platform = resolvePlatform(q.state);`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00
			`// User denied or Google returned an error`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const makeErrorUrl = (msg: string) =>`
			`${env.webAppUrl}/login?error=${encodeURIComponent(msg)}`;

feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`if (error \|\| !code) {`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const url = makeErrorUrl(error ?? 'missing_code');`
			`if (platform === 'tauri') return renderTauriDeepLinkPage(url);`
fix(auth): replace deprecated set.redirect with manual 302 Location header 2026-06-15 22:06:59 +07:00			`set.status = 302;`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`set.headers['Location'] = url;`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`return;`
			`}`

			`// Exchange authorization code for tokens`
			`let idPayload: GoogleIdPayload;`
			`try {`
			`const tokens = await exchangeGoogleCode(code);`
			`idPayload = decodeGoogleIdToken(tokens.id_token);`
			`} catch (err) {`
			`const msg = err instanceof Error ? err.message : 'Google auth failed';`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const url = makeErrorUrl(msg);`
			`if (platform === 'tauri') return renderTauriDeepLinkPage(url);`
fix(auth): replace deprecated set.redirect with manual 302 Location header 2026-06-15 22:06:59 +07:00			`set.status = 302;`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`set.headers['Location'] = url;`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`return;`
			`}`

			`// Validate email`
			`if (!idPayload.email_verified \|\| !idPayload.email) {`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const url = makeErrorUrl('Email not verified by Google');`
			`if (platform === 'tauri') return renderTauriDeepLinkPage(url);`
fix(auth): replace deprecated set.redirect with manual 302 Location header 2026-06-15 22:06:59 +07:00			`set.status = 302;`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`set.headers['Location'] = url;`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`return;`
			`}`

			`const googleId = idPayload.sub;`
			`const email = idPayload.email.trim().toLowerCase();`
			`const name = idPayload.name?.trim() ?? email.split('@')[0];`

			`try {`
			`const db = createDbClient();`

			`let user = await db.select().from(users).where(eq(users.googleId, googleId)).limit(1).then(r => r[0] ?? null);`

			`if (!user) {`
			`user = await db.select().from(users).where(eq(users.email, email)).limit(1).then(r => r[0] ?? null);`
			`if (user) {`
			`await db.update(users).set({ googleId }).where(eq(users.id, user.id));`
			`}`
			`}`

			`if (!user) {`
			`const inserted = await db`
			`.insert(users)`
			`.values({ email, name, googleId, role: 'user' })`
			`.returning();`
			`user = inserted[0];`
			`authCounter.labels('register', 'true').inc();`
			`}`

			`const token = await createSession(user.id);`
			`set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);`

			`authCounter.labels('login', 'true').inc();`

feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			const successUrl = `${env.webAppUrl}/login?token=${encodeURIComponent(token)}`;
			`if (platform === 'tauri') return renderTauriDeepLinkPage(successUrl);`
fix(auth): replace deprecated set.redirect with manual 302 Location header 2026-06-15 22:06:59 +07:00			`set.status = 302;`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`set.headers['Location'] = successUrl;`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`} catch (err) {`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`const url = makeErrorUrl('Database unavailable');`
			`if (platform === 'tauri') return renderTauriDeepLinkPage(url);`
fix(auth): replace deprecated set.redirect with manual 302 Location header 2026-06-15 22:06:59 +07:00			`set.status = 302;`
feat(android): Google OAuth via system browser + deep link for Android 2026-06-15 23:49:47 +07:00			`set.headers['Location'] = url;`
feat(auth): implement Google OAuth callback with user auto-creation 2026-06-15 21:35:20 +07:00			`}`
feat: add session auth routes 2026-05-22 15:53:48 +00:00			`});`