Enable Google OAuth provider on Supabase (client id/secret + redirect URI)
Done normal
cwcoder-webcertify-cc
Supabase built-in sender only delivers to org members, 2/hour, not for prod. auth.users has 0 rows so password auth needs admin provisioning of both app_users before day one. Site URL https://webcertify.pensanta.com, redirect /auth/callback. Rob supplies SMTP creds on request.
Activity
-
Domain webcertify.pensanta.com already attached+verified on Vercel, DNS 76.76.21.21, HTTP 200 (2026-10-08) - no DNS work left.
-
SMTP app password received (stored in git-ignored .env.local as SMTP_PASS). supabase/config.toml edited: site_url=https://webcertify.pensanta.com, additional_redirect_urls=[prod+local /auth/callback], email_sent=30, [auth.email.smtp] gmail 587 with env(SMTP_USER)/env(SMTP_PASS). Apply via 'supabase config push' after link - needs PAT (WEBCERTI-3) and the Gmail sender address.
-
parent=WEBCERTI-9
-
Elazar 2026-10-08: auth is Google OAuth with account chooser, NOT emailed magic links. Code shipped v0.1.15 (login route -> signInWithOAuth google, prompt=select_account; page shows 'Continuar con Google'; allowlist enforced in /auth/callback). Custom SMTP is no longer needed for login - the Gmail app password is unused for auth. REMAINING: enable the Google provider on the Supabase project (dashboard Authentication > Sign In / Providers > Google, or 'supabase config push' once PAT lands) with a Google Cloud OAuth 2.0 Web client whose authorized redirect URI is https://ibfghiscoeqvpdnzwfap.supabase.co/auth/v1/callback. config.toml already carries [auth.external.google] reading env(SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID/_SECRET).
-
Enable Google OAuth provider on Supabase (client id/secret + redirect URI)
-
Google side done (WEBCERTI-12). Remaining work is one command: SUPABASE_ACCESS_TOKEN=sbp_... ./scripts/enable-google-auth.sh (commit 665ef15), which PATCHes external_google_enabled/_client_id/_secret plus site_url and uri_allow_list in one call and asserts the 302. Blocked only on Elazar supplying a Supabase Personal Access Token - api.supabase.com returns 401 without one, the mcp.supabase.com connection has no auth-config write, ~/.supabase holds no token. Depends on WEBCERTI-3.
-
cleared: Google side done (WEBCERTI-12). Remaining work is one command: SUPABASE_ACCESS_TOKEN=sbp_... ./scripts/enable-google-auth.sh (commit 665ef15), which PATCHes external_google_enabled/_client_id/_secret plus site_url and uri_allow_list in one call and asserts the 302. Blocked only on Elazar supplying a Supabase Personal Access Token - api.supabase.com returns 401 without one, the mcp.supabase.com connection has no auth-config write, ~/.supabase holds no token. Depends on WEBCERTI-3.
-
Applied via scripts/enable-google-auth.sh with a PAT Elazar supplied 2026-10-08. Readback of /v1/projects/ibfghiscoeqvpdnzwfap/config/auth: external_google_enabled=true, client_id=262649174718-ntp4js6fdm9l9n6irhhag43cepg9mpb8.apps.googleusercontent.com, secret set, site_url=https://webcertify.pensanta.com, uri_allow_list=https://webcertify.pensanta.com/auth/callback. The hosted allow-list was EMPTY beforehand, confirming config.toml additional_redirect_urls had never reached the project. /auth/v1/settings now reports google:true and /auth/v1/authorize?provider=google returns 302 to accounts.google.com with our client_id. Script's verify initially failed because the PATCH returns before the auth service reloads; added retry+backoff (commit 3a97977). No end-to-end browser sign-in performed - that is WEBCERTI-7.
task
1w ago by coder-webcertify-cc
1w ago
2026-10-08 09:46