Fix Google sign-in on MCP authorization page

[thomasluizon]

Change

Fixes thomasluizon/orbit-tickets#945.

The MCP authorize page now links to /oauth/google/start, which redirects in the same tab to Google's authorization endpoint with a fresh state and PKCE challenge. OAuthAuthorizationStore keeps the client ID, client redirect URI, original state, MCP challenge, nonce, Google verifier, and callback URI in a five minute, single-use server record. /oauth/google/callback consumes that record, signs in through GoogleCodeAuthCommand, issues the existing MCP authorization code, and redirects to the client. Google cancellation and exchange failures return to the authorize page with an English or Portuguese error while leaving email sign-in available.

This shape keeps the existing Google account resolution and MCP token exchange. The MCP flow does not store identity-only Google tokens as calendar credentials. The One Tap script and its obsolete tests are removed. POST /oauth/google stays as a deprecated route, so the OpenAPI contract gate keeps passing; a follow-up ticket deletes it. Changes are in OAuthController.cs, OAuthAuthorizationStore.cs, OAuthLoginPage.cs, GoogleCodeAuthCommand.cs, the agent action catalog, the generated OpenAPI document, and their unit tests.

Assumptions

• The existing singleton OAuthAuthorizationStore is the intended server-side store for this flow, rather than a new distributed store, because current MCP authorization codes also live there.
• Error language follows the request's Accept-Language header, rather than a new query parameter, because the authorize page has no locale parameter.
• The MCP Google request asks for openid email profile, rather than calendar scope, because account sign-in only needs identity and the command now preserves existing calendar credentials.
• The restored POST /oauth/google endpoint is cataloged under the existing authentication capability, not a new capability for the same action.
• The Google state is stored in the pending request, and the authorization URL is built from the stored value, not from the query parameter.

Manual steps

• Done before merge: both callback URIs (https://api.useorbit.org/oauth/google/callback and https://api-staging.useorbit.org/oauth/google/callback) are registered on the Google OAuth web client.
• After merge, apply the targeted Terraform change in infra/ for both API environment groups (orbit-production-api, orbit-staging-api) and release both API environments through release.yml. Confirm Google__AllowedRedirectUris__1 is https://api.useorbit.org/oauth/google/callback in production and Google__AllowedRedirectUris__3 is https://api-staging.useorbit.org/oauth/google/callback in staging. On each host, verify that the Google button opens account selection and a completed sign-in returns to the MCP client.

Test evidence

• Before the fix, dotnet test tests/Orbit.Infrastructure.Tests/Orbit.Infrastructure.Tests.csproj --filter FullyQualifiedName~OAuthControllerTests.Authorize_ValidParams_ReturnsHtmlContent -v normal passed one test while the page still contained One Tap.
• After strengthening that test to require /oauth/google/start?state= and reject google.accounts.id, dotnet test tests/Orbit.Infrastructure.Tests/Orbit.Infrastructure.Tests.csproj --filter FullyQualifiedName~OAuthControllerTests.Authorize_ValidParams_ReturnsHtmlContent --no-restore -v quiet failed one test before implementation. The same command passed one test after implementation.
• Before the calendar credential fix, dotnet test tests/Orbit.Application.Tests/Orbit.Application.Tests.csproj --filter FullyQualifiedName~GoogleCodeAuthCommandHandlerTests.ExistingUser_PreservesOrReplacesRefreshToken --no-restore -v quiet passed two cases. The new McpIdentityOnlyExchange_DoesNotReplaceCalendarTokens test failed one case against the previous command behavior, then passed after the MCP mode was added.
• Focused OAuth controller and store tests passed 67 tests. dotnet build Orbit.slnx --no-restore -v quiet finished with zero errors. dotnet test -v quiet passed 6,951 tests across four projects. node tools/arch-map.mjs, the dash check, and the timeless check passed.
• Review batch be60d5fa: the unchanged OAuth tests passed with the defect present (dotnet test tests/Orbit.Infrastructure.Tests --filter FullyQualifiedName~OAuthControllerTests --no-restore, 51 of 51).
• The strengthened suite failed before the fix: the forged stored redirect returned a RedirectResult, and the deprecated route was absent. Both pass after the fix. The unavailable and nonce cases passed before and after.
• Restoring the route exposed an unmapped controller action in the full suite. That catalog test failed before the catalog entry and passed after it.
• Final focused suite 60 of 60. dotnet build Orbit.slnx --no-restore 0 errors. Full dotnet test Orbit.slnx --no-restore passed with LANG unset and again with LC_ALL=en_US.UTF-8, 6,959 tests in each run.
• terraform fmt -check passed. terraform validate did not run to completion in the worktree because it lacks the cached provider plugins.

External interface evidence

A real GET to https://accounts.google.com/.well-known/openid-configuration returned authorization_endpoint: https://accounts.google.com/o/oauth2/v2/auth, response_types_supported containing code, response_modes_supported containing query, scopes_supported containing openid, email, and profile, and code_challenge_methods_supported containing S256. Re-run curl --silent --show-error https://accounts.google.com/.well-known/openid-configuration to inspect the complete live response. A request to that authorization endpoint with an invalid client returned HTTP 302 to Google's signin/oauth/error page with invalid_client, confirming the endpoint responds. The callback reads the standard OAuth code, error, and state query parameters specified by the ticket and OAuth 2.0 authorization code response schema. A live successful Google callback cannot be captured until the console redirect URIs are registered.

[pullfrog]

Important

The new Google start endpoint depends on callback allowlist configuration that is missing from the Terraform-managed API environments. Keep this prerequisite in the managed configuration before shipping.

Reviewed changes in all nine files across the four commits through e060bf1:

• Google authorization redirect: Replaces One Tap with an opaque, single-use Google state and PKCE flow that returns to the MCP client's original request.
• Sign-in behavior: Reuses Google code exchange without overwriting existing calendar tokens, with localized failure redirects back to email sign-in.
• Contract and coverage: Updates OpenAPI and the agent catalog, removes obsolete One Tap tests, and exercises state binding, expiry, and callback outcomes.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review at e060bf1:

• Managed callback configuration: Added the production and staging API callback URIs to Terraform while retaining the existing web redirect URIs.
• Legacy endpoint compatibility: Restored POST /oauth/google as deprecated in the controller and OpenAPI, and cataloged it alongside the new redirect actions.
• Callback safety and coverage: Revalidated the stored MCP redirect before issuing a code and added tests for invalid redirects, unavailable configuration, and localized fallback errors.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
12 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud