Delete the deprecated POST /oauth/google route (#957)

[thomasluizon]

Closes #957.

api#660 moved the MCP authorize page's Google sign-in to an authorization-code redirect through /oauth/google/start and /oauth/google/callback. It kept POST /oauth/google (the old One Tap tokeninfo path) only so the OpenAPI contract gate would keep passing. This deletes it.

What changed

• POST /oauth/google, the OAuthController.GoogleAuthRequest record and FindOrCreateGoogleUserAsync are gone from src/Orbit.Api/Controllers/OAuthController.cs.
• The two constructor dependencies that only that route used, IGenericRepository<User> and IHttpClientFactory, are gone with it, along with the imports they orphaned.
• OAuthController.GoogleAuth is removed from the agent catalog in AgentCatalogService.Capabilities.cs.
• ErrorCodes.GoogleTokenAudienceMismatch and ErrorMessages.GoogleTokenAudienceMismatch are removed: the deleted route was their only call site.
• src/Orbit.Api/openapi.json is regenerated. Only the /oauth/google path entry disappears. The GoogleAuthRequest component schema stays, because the generator binds that name to AuthController.GoogleAuthRequest, which /api/Auth/google still uses.

No caller remains

• src/Orbit.Api/OAuth/OAuthLoginPage.cs links to /oauth/google/start.
• thomasluizon/orbit-ui-mobile on both origin/main and origin/redesign/main: no source hit for oauth/google or GOOGLE_TOKEN_AUDIENCE_MISMATCH. The only hit anywhere is a prose line in .claude/specs/orbit-prod-release.md that asks for this ticket.
• No documented external client in this repository calls it.

Contract gate

The route already carried deprecated: true on main, so no extra record is needed. I built oasdiff v1.32.1, the version oasdiff/oasdiff-action/breaking@5e81b5c pins in its Dockerfile, and ran it against origin/main with this repository's .oasdiff.yaml:

$ oasdiff breaking origin/main:src/Orbit.Api/openapi.json src/Orbit.Api/openapi.json --fail-on ERR
No breaking changes to report, but the specs are different.
EXIT=0

$ oasdiff changelog origin/main:src/Orbit.Api/openapi.json src/Orbit.Api/openapi.json
1 changes: 0 error, 0 warning, 1 info
info	[api-path-removed-with-deprecation] in API POST /oauth/google

api-path-removed-with-deprecation is INFO in checker/rules.go, and the job sets fail-on: ERR, so the OpenAPI Breaking-Change Gate passes.

Test evidence

This is a deletion, not a defect fix, so there is no defect to reproduce. The closest equivalent applies: an existing test asserted the opposite of the acceptance criterion, and I ran it unchanged against the deletion before I touched it.

1. Existing test unchanged, route deleted. dotnet test tests/Orbit.Infrastructure.Tests --no-build --filter "FullyQualifiedName~OAuthControllerTests.GoogleAuth_RouteRemainsAvailableAndDeprecated" fails for the intended reason:

Failed OAuthControllerTests.GoogleAuth_RouteRemainsAvailableAndDeprecated
  Expected route not to be <null>.
Failed!  - Failed: 1, Passed: 0, Total: 1

2. Test inverted to assert the removal. GoogleAuth_OneTapRoute_IsGoneSoAPostTo_OauthGoogle_Returns404 scans every HttpMethodAttribute template on every ControllerBase in the Orbit.Api assembly, asserts /oauth/google is absent, and asserts the two replacement routes are still present, so a rename cannot make it pass by accident. Nothing serves /oauth/google any more, so a POST to it falls through to a 404.

3. After the change, the whole suite passes. dotnet test Orbit.slnx --no-build:

Orbit.Analyzers.Tests        Passed: 32,   Failed: 0
Orbit.Domain.Tests           Passed: 630,  Failed: 0
Orbit.Application.Tests      Passed: 3716, Failed: 0
Orbit.Infrastructure.Tests   Passed: 2599, Failed: 0

node tools/check-suppression-allowlist.mjs, node tools/check-timeless.mjs --base origin/main, node tools/check-dashes.mjs, node tools/check-root-allowlist.mjs and node tools/arch-map.mjs all exit 0.

Assumptions

• The acceptance criterion "the route returns 404" is proven by a reflection test over route templates, not by a live request, because a worker must never start a server. Rejected alternative: an integration test that boots the app, which this repository also forbids.
• ErrorCodes.GoogleTokenAudienceMismatch is deleted rather than kept. The deleted route was its only producer and no consumer references the literal GOOGLE_TOKEN_AUDIENCE_MISMATCH in either repository. Rejected alternative: keeping a dead error code for a route that no longer exists.
• #pragma warning disable S107 on the controller stays, even though the constructor now takes 7 parameters. I could not read Sonar's threshold from a real source, and SonarCloud Code Analysis is a required check, so I left a suppression that may still be live rather than remove it on memory. Rejected alternative: deleting the pragma and its tools/suppression-allowlist.json entry.
• gating-matrix.json is left untouched. Running the generator locally rewrote only its provenance hash and input-file count, which is local-environment drift and not a product of this change. Rejected alternative: committing that churn.
• The pre-existing unused using System.Security.Claims; in OAuthControllerTests.cs stays. It was already unused on main, so this change did not orphan it. Rejected alternative: an unrelated cleanup in a deletion PR.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes The deprecated MCP One Tap endpoint deletion, its contract and catalog cleanup, and the replacement route assertions were reviewed against the remaining OAuth flow and the sibling consumer.

• Route removal: POST /oauth/google and its tokeninfo user provisioning path are deleted; /oauth/google/start and /oauth/google/callback remain available to the MCP authorize page.
• Contract cleanup: OpenAPI removes the deprecated path while the separate /api/auth/google request schema remains; the now-unused audience mismatch declarations and catalog entry are removed.
• Test coverage: The controller test asserts the removed route template is absent across controllers and both replacement templates remain. The sibling shared endpoints target /api/auth/google, not the deleted route.

  ^{｜ View workflow run ｜ Using GPT Sol ｜ 𝕏}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud