WP-AUTH-GOOGLE-01 — Audit + prep (OWNER Client ID chưa có)

Cập nhật: 2026-08-07 · Google path PREPARED · Firebase Hybrid IMP code Firebase Auth IdP → Nest: OWNER-FIREBASE-HYBRID.md · POST /auth/firebase Gap-closure: placeholder Client ID bị reject · real Google/Firebase e2e vẫn OWNER_REQUIRED (service account + OAuth clients)

1. Audit source

Hạng mục	Giá trị
Package FE	`expo-auth-session` `~7.0.11` · `expo-web-browser` `~15.0.11` · `expo-crypto` `~15.0.9` (SDK 54)
Package BE	`google-auth-library` (verify ID token)
Scheme / redirect	`welife://oauth` (`app.json` `scheme: welife` · `makeRedirectUri`)
Android package	`cloud.minhtien.welife`
iOS bundle	`cloud.minhtien.welife`
Endpoint	`POST /auth/google` `{ idToken, surface?, fullName? }`
Deprecated	`POST /auth/social/login` — từ chối `provider=GOOGLE` (không nhận sub/email thô)
FE client	`AuthApi.googleLogin(idToken)` → chỉ gửi idToken
Firebase files	`google-services.json` / `GoogleService-Info.plist` — không thay Web OAuth Client ID (`oauth_client: []`)

Env FE (public)

EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID (bắt buộc để bật nút)
EXPO_PUBLIC_GOOGLE_ANDROID_CLIENT_ID
EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID
Alias optional: EXPO_PUBLIC_GOOGLE_CLIENT_ID / EXPO_PUBLIC_GOOGLE_EXPO_CLIENT_ID

Env BE

GOOGLE_CLIENT_ID (Web — audience verify)
GOOGLE_CLIENT_IDS (comma) · GOOGLE_WEB_* / GOOGLE_ANDROID_* / GOOGLE_IOS_*

2. Account linking policy

Verify JWT Google (aud ∈ Client IDs) — không trust client sub/email.
Primary key: SocialAccount(GOOGLE, sub).
New sub: bắt buộc email + email_verified === true.
Link User cùng email chỉ khi Google đã verify email (= identity email-OTP).
Không merge theo email chưa verified / email do client gửi.

3. FE load isolation

googleClientIds.ts không import expo-auth-session. Chỉ khi đã có Web Client ID mới require(GoogleSignInActive) → tránh ExpoCryptoAES khi OWNER chưa cấu hình. Email OTP luôn độc lập.

4. OWNER next

Tạo OAuth 2.0 Web Client ID trên Google Cloud (project Firebase welife-13324 hoặc GCP liên kết) → điền:

# mobile/.env(.local)
EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID=….apps.googleusercontent.com

# api/.env
GOOGLE_CLIENT_ID=….apps.googleusercontent.com

Rồi npx expo start -c + restart API → smoke Login Google.