feat(auth): Sign in with Google (identity-only) on login #4083 — ccantynz/alecrae.com

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/48

What

Adds a "Sign in with Google" option to the login page. This is identity-only (OpenID Connect: openid/email/profile) and is deliberately separate from the existing Gmail mailbox connection (which uses the full gmail.* scopes to read/send a user's mail). Passkey remains the hero auth method; Google sits underneath as a quieter secondary option.

Why

~90% of the Gmail/Outlook users we're converting already have a Google account. A one-tap sign-in removes the biggest signup-friction point for exactly that audience — without making Google the face of our login, and without any competitive cost (their mail never routes through Google; this is purely identity).

Changes

API

GET /v1/auth/google — starts the flow (redirects to Google with an HMAC-signed CSRF state)
GET /v1/auth/callback/google — exchanges the code, finds-or-creates the user (OAuth-only users get a null password hash), issues the standard token pair, and redirects to the web app with the access token in the URL fragment (kept out of logs/referrers)
apps/api/src/lib/google-auth.ts — identity-only OAuth helper with its own GOOGLE_AUTH_REDIRECT_URI (separate from the gmail-connect GOOGLE_REDIRECT_URI)
apps/api/src/lib/oauth-state.ts — signAuthState/verifyAuthState for the unauthenticated sign-in flow

Web

Secondary "Sign in with Google" button under Passkey on the login page
/google/callback landing page that stores the session (mirrors login/register/passkey) and routes to the inbox
Login error banner for failed callbacks

Config

Documented GOOGLE_AUTH_REDIRECT_URI in .env.production

Required setup in Google Cloud Console

Gmail connection: https://api.alecrae.com/v1/connect/callback/gmail
Google sign-in: https://api.alecrae.com/v1/auth/callback/google

Verification

bun run typecheck — API ✅ / web ✅
bun run lint — 0 errors (pre-existing console.log warnings only, none in new code)

https://claude.ai/code/session_01McgJLnTbZG9mwhfwd5iAX3

Generated by Claude Code