cesnimda
63 lines
3.1 KiB
Markdown
63 lines
3.1 KiB
Markdown
# Google OAuth2 Setup
|
|
|
|
InboxIntel logs users in with Google only. The `GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` you create here identify the **application** to Google — every user (you or anyone else) signs in through this one credential pair. They are required; without them nobody can log in.
|
|
|
|
## 1. Create the OAuth client
|
|
|
|
1. Go to the [Google Cloud Console](https://console.cloud.google.com/) and create (or pick) a project.
|
|
2. **APIs & Services → Library →** enable the **Gmail API**.
|
|
3. **APIs & Services → OAuth consent screen:**
|
|
- User type: **External**.
|
|
- Fill app name, support email, developer email.
|
|
- **Scopes:** add `openid`, `email`, `profile`, `.../auth/gmail.readonly`, `.../auth/gmail.modify`.
|
|
4. **APIs & Services → Credentials → Create credentials → OAuth client ID:**
|
|
- Application type: **Web application**.
|
|
- **Authorized redirect URIs** — add the one(s) matching how you run it:
|
|
|
|
| How you run it | Redirect URI |
|
|
|---|---|
|
|
| Docker (frontend on :8081) | `http://localhost:8081/signin-google` |
|
|
| Docker + top-level nginx (`--profile proxy`, :80) | `http://localhost/signin-google` |
|
|
| Local dev (API via `dotnet run`, :5080) | `http://localhost:5080/signin-google` |
|
|
| Production | `https://your-domain/signin-google` |
|
|
|
|
- Copy the generated **Client ID** and **Client secret**.
|
|
|
|
## 2. Put the credentials where the app reads them
|
|
|
|
Docker — in `.env` at the repo root:
|
|
|
|
```
|
|
GOOGLE_CLIENT_ID=xxxxx.apps.googleusercontent.com
|
|
GOOGLE_CLIENT_SECRET=xxxxx
|
|
```
|
|
|
|
Local dev — use user-secrets so they never touch source control:
|
|
|
|
```bash
|
|
cd src/InboxIntel.Api
|
|
dotnet user-secrets init
|
|
dotnet user-secrets set "GoogleOAuth:ClientId" "xxxxx.apps.googleusercontent.com"
|
|
dotnet user-secrets set "GoogleOAuth:ClientSecret" "xxxxx"
|
|
```
|
|
|
|
## 3. Who is allowed to log in
|
|
|
|
This is controlled by the **consent screen publishing status**, not the app code (the code already creates a new user row per Google account — it does not restrict to one person):
|
|
|
|
- **Testing** (default): only Google accounts you add under *Test users* can sign in (max 100).
|
|
- **In production** (click **Publish app**): any Google account can sign in.
|
|
|
|
### Caveat for the Gmail scopes
|
|
|
|
`gmail.readonly` and `gmail.modify` are **restricted scopes**. A published-but-unverified app still works, but:
|
|
|
|
- users see a "Google hasn't verified this app" warning screen, and
|
|
- you're capped at **100 users** until Google verifies the app.
|
|
|
|
Removing the warning / going beyond 100 users requires Google's OAuth verification (a CASA security assessment for restricted scopes). For personal or small-team use, published-unverified (≤100 users) is usually fine.
|
|
|
|
## 4. Redirect URI must match exactly
|
|
|
|
The URI registered in the Console must character-for-character match what the app sends. The app builds it from the request's host + scheme; behind nginx, `UseForwardedHeaders` + the `X-Forwarded-Proto`/`Host` headers (already configured) make that the **external** URL, and nginx routes `/signin-google` to the API. If you get `redirect_uri_mismatch`, compare the URI in the browser's address bar during the error against what's registered.
|