From 9ad812e9ba7267114e4225bf28315ac7698856ed Mon Sep 17 00:00:00 2001 From: cesnimda Date: Sun, 30 Aug 2026 22:16:59 +0200 Subject: [PATCH] fix(auth): initialize Google Identity once --- docs/audits/verification-log.md | 1 + docs/work-programmes/master-progress.md | 4 +- .../src/components/GoogleAuthCard.tsx | 85 +++++++++++++------ job-tracker-ui/src/login-page.test.tsx | 4 +- 4 files changed, 63 insertions(+), 31 deletions(-) diff --git a/docs/audits/verification-log.md b/docs/audits/verification-log.md index 7c79f82..7815943 100644 --- a/docs/audits/verification-log.md +++ b/docs/audits/verification-log.md @@ -240,3 +240,4 @@ Output was reduced to filenames and commit counts. The token artifact appears un | V-206 | Ownership/migration chain; populated adoption/downgrade/retry; practice-state/FK/index assertions; MariaDB script; full backend | Repository root / disposable local SQLite | Move durable interview-preparation items to migration ownership without losing user or AI preparation content | PASS — focused ownership/migration 18/18; user-authored and AI-generated questions, answers, prepared state and source metadata survive adoption, downgrade and re-upgrade; owner/job/sort index exists; deleting the parent application cascades through preparation items; generated MariaDB SQL is provider-safe; startup no longer creates the table; full backend 734/734 | MariaDB SQL generated only; no provider account or production migration. Guarded malformed-empty/index/auto-increment repair remains temporarily. Fifteen reconciler-owned tables remain | JT-019 feature-table transfers complete; the Career Profile aggregate and Identity group remain dependency-aware batches | | V-207 | Ownership/migration chain; populated aggregate adoption/downgrade/retry; JSON/text/FK/index assertions; MariaDB script; full backend | Repository root / disposable local SQLite | Move the canonical Career Profile, append-only history, and six relational child types to migration ownership without losing career data | PASS — focused ownership/migration 19/19; canonical and long-tail JSON, Norwegian text, version history, experience, education, skill, project, certification and language rows survive adoption, downgrade and re-upgrade; all 14 aggregate indexes exist; deleting the profile cascades through history and children; generated MariaDB SQL uses bounded indexed keys and provider-safe types; startup creates none of the eight tables; full backend 735/735 | MariaDB SQL generated only; no production migration. Guarded historical LongTailJson/index/auto-increment repairs remain temporarily. Seven reconciler-owned Identity tables remain | JT-019 feature and career transfers complete; isolate the Identity ownership boundary next | | V-208 | Ownership/migration chain; populated Identity adoption/downgrade/retry; credential/preference/FK/index assertions; MariaDB script; full backend; fresh application startup | Repository root / disposable local SQLite | Complete JT-019 by moving the seven ASP.NET Identity tables to migration ownership without invalidating authentication data | PASS — focused ownership/migration 20/20; password hash, Bokmål preference, 2FA state, role assignment, role/user claims, external login and token survive adoption, downgrade and re-upgrade; all eight Identity indexes exist; user and role deletion cascades remain effective; generated MariaDB SQL is provider-safe; startup creates no model tables; full backend 736/736; a fresh application applies the complete chain, reaches Identity role initialization and listens normally | MariaDB SQL generated only; no production migration. The historical AspNetUsers compatibility bootstrap and guarded column/index repairs remain for chain traversal and legacy upgrades. Launch settings supplied an existing policy-invalid development admin password, producing a non-fatal seed warning | JT-019 complete; future work may retire individual repair statements only after provider-backed historical fixtures prove them redundant | +| V-209 | Google Identity initialization regression; focused login Jest; ESLint; TypeScript; complete Playwright | `job-tracker-ui` / disposable local application | Remove repeated global Google SDK initialization without changing sign-in or account-link behavior | PASS — SDK initialization is stable per loaded Identity API/client ID while the mounted card owns the current credential handler; login 13/13, lint and TypeScript pass; Playwright 10/10 covers authentication, job creation/workspace, Career Workspace and searchable PDF exports with no repeated-initialize warning | Synthetic Google callback only; no real provider credential, account link or production call | Repeatable browser-console defect closed; real-provider verification remains externally gated | diff --git a/docs/work-programmes/master-progress.md b/docs/work-programmes/master-progress.md index d42ce38..aa4c69f 100644 --- a/docs/work-programmes/master-progress.md +++ b/docs/work-programmes/master-progress.md @@ -90,7 +90,7 @@ Updated: 2026-08-30 - Next production build and TypeScript: passed. - Full backend: 736/736 tests passed after completing the Identity/JT-019 ownership transfer. - Portable Playwright launcher: resolved the user-local .NET 9 SDK; backend Release build passed with 0 warnings/errors. -- Playwright: initial full run 9/10 exposed the intentional mobile Settings control change; updated focused rerun passed 1/1. A final complete browser rerun remains in the end-of-batch gate. +- Playwright: final complete browser rerun passed 10/10, including authenticated job creation/workspace flows and both public and long searchable multi-page CV PDF exports. - Focused backend match/intelligence verification: 34/34 passed. - Focused frontend application-intelligence verification: 11/11 passed. - Career/Profile focused verification: 2 suites, 19/19 passed, including the final navigation/state-preservation regression; final full-suite/E2E gates remain pending. @@ -117,7 +117,7 @@ Updated: 2026-08-30 - Shared view-state focused verification: 3 suites and 15/15 tests passed, including Bokmål loading/retry and Kanban interaction coverage; TypeScript passed. - Admin Audit/settings/profile focused verification: 3 suites and 17/17 tests passed, including unavailable-versus-empty recovery and Bokmål audit actions that preserve stored event content; TypeScript passed. - Turnstile/auth recovery focused verification: 4 suites and 18/18 tests passed; the provider widget receives the Bokmål language code and TypeScript passed. -- Final shared-state/localization regression: all 64 frontend suites and 272/272 tests passed; optimized Next build and integrated TypeScript passed; complete Playwright passed 10/10, including public PDF and the searchable multi-page Code template. Only the pre-existing Google Identity development logger warning remained. +- Final shared-state/localization regression: all 64 frontend suites and 272/272 tests passed; optimized Next build and integrated TypeScript passed; complete Playwright passed 10/10, including public PDF and the searchable multi-page Code template. Google Identity now initializes its global SDK once while rerenders replace only the active credential handler; the focused login regression, ESLint, TypeScript and a fresh 10/10 browser run pass without the repeated-initialize warning. - Admin/correspondence/profile helper-copy verification: 3 suites and 22/22 tests passed, including a Bokmål SMTP-message regression; TypeScript passed. - Local toolchain/lint verification: Python 3.12.10; sidecar 26/26 tests passed with five existing SWIG deprecation warnings; ESLint passes with zero warnings; frontend 64 suites and 272/272 tests passed; optimized Next build and integrated TypeScript passed; npm audit reports zero vulnerabilities. - Backend matcher/intelligence focused verification: 35/35 passed, including detection of a manually created Norwegian advert with no saved translation. diff --git a/job-tracker-ui/src/components/GoogleAuthCard.tsx b/job-tracker-ui/src/components/GoogleAuthCard.tsx index b812b3b..7f216d7 100644 --- a/job-tracker-ui/src/components/GoogleAuthCard.tsx +++ b/job-tracker-ui/src/components/GoogleAuthCard.tsx @@ -10,10 +10,38 @@ import { useI18n } from "../i18n/I18nProvider"; declare global { interface Window { - google?: any; + google?: { + accounts?: { + id?: GoogleIdentityApi; + }; + }; } } +type GoogleCredentialResponse = { + credential?: string; +}; + +type GoogleIdentityApi = { + initialize: (options: { client_id: string; callback: (response: GoogleCredentialResponse) => void }) => void; + renderButton: (host: HTMLElement, options: Record) => void; +}; + +let initializedIdentityApi: GoogleIdentityApi | null = null; +let initializedClientId = ""; +let activeCredentialHandler: ((response: GoogleCredentialResponse) => void) | null = null; + +function initializeGoogleIdentity(identityApi: GoogleIdentityApi, clientId: string) { + if (initializedIdentityApi === identityApi && initializedClientId === clientId) return; + + identityApi.initialize({ + client_id: clientId, + callback: (response) => activeCredentialHandler?.(response), + }); + initializedIdentityApi = identityApi; + initializedClientId = clientId; +} + type MeResponse = { provider?: "local" | "google" | "external"; email?: string; @@ -100,37 +128,37 @@ export default function GoogleAuthCard({ onSignedIn, presentation = "account" }: let active = true; void loadGoogleScript() .then(() => { - if (!active || !window.google?.accounts?.id || !hostRef.current) return; + const identityApi = window.google?.accounts?.id; + if (!active || !identityApi || !hostRef.current) return; hostRef.current.replaceChildren(); - window.google.accounts.id.initialize({ - client_id: clientId, - callback: async (resp: any) => { - const credential = resp?.credential as string | undefined; - if (!credential) return; - setWorking(true); - try { - if (!signInOnly && me?.provider === "local") { - const res = await api.post<{ linked: boolean; email?: string | null }>("/auth/google/link", { token: credential, rememberMe: getAuthPersistencePreference() === "local" }); - toast(res.data?.email ? t("googleLinkedSuccessWithEmail", { email: res.data.email }) : t("googleLinkedSuccess"), "success"); - await refreshMe(); + const credentialHandler = async (resp: GoogleCredentialResponse) => { + const credential = resp?.credential as string | undefined; + if (!credential) return; + setWorking(true); + try { + if (!signInOnly && me?.provider === "local") { + const res = await api.post<{ linked: boolean; email?: string | null }>("/auth/google/link", { token: credential, rememberMe: getAuthPersistencePreference() === "local" }); + toast(res.data?.email ? t("googleLinkedSuccessWithEmail", { email: res.data.email }) : t("googleLinkedSuccess"), "success"); + await refreshMe(); + } else { + const res = await api.post<{ requiresTwoFactor?: boolean; pendingToken?: string }>("/auth/google/exchange", { token: credential, rememberMe: getAuthPersistencePreference() === "local" }); + if (res.data?.requiresTwoFactor && res.data.pendingToken) { + setPendingToken(res.data.pendingToken); } else { - const res = await api.post<{ requiresTwoFactor?: boolean; pendingToken?: string }>("/auth/google/exchange", { token: credential, rememberMe: getAuthPersistencePreference() === "local" }); - if (res.data?.requiresTwoFactor && res.data.pendingToken) { - setPendingToken(res.data.pendingToken); - } else { - window.dispatchEvent(new Event("auth-changed")); - toast(t("googleSignedIn"), "success"); - onSignedIn?.(); - } + window.dispatchEvent(new Event("auth-changed")); + toast(t("googleSignedIn"), "success"); + onSignedIn?.(); } - } catch (e: any) { - toast(getApiErrorMessage(e, t("googleAuthFailed")), "error"); - } finally { - setWorking(false); } - }, - }); - window.google.accounts.id.renderButton(hostRef.current, { + } catch (e: unknown) { + toast(getApiErrorMessage(e, t("googleAuthFailed")), "error"); + } finally { + setWorking(false); + } + }; + activeCredentialHandler = credentialHandler; + initializeGoogleIdentity(identityApi, clientId); + identityApi.renderButton(hostRef.current, { theme: "outline", size: "large", type: "standard", @@ -142,6 +170,7 @@ export default function GoogleAuthCard({ onSignedIn, presentation = "account" }: return () => { active = false; + activeCredentialHandler = null; host.replaceChildren(); }; }, [clientId, me?.provider, me?.googleLink?.linked, onSignedIn, signInOnly, signedIn, toast, t]); diff --git a/job-tracker-ui/src/login-page.test.tsx b/job-tracker-ui/src/login-page.test.tsx index ae29ed6..07c0783 100644 --- a/job-tracker-ui/src/login-page.test.tsx +++ b/job-tracker-ui/src/login-page.test.tsx @@ -155,8 +155,9 @@ describe('LoginPage', () => { it('completes a Google credential return without account-linking copy', async () => { process.env.NEXT_PUBLIC_GOOGLE_CLIENT_ID = 'google-client'; let callback: ((response: { credential: string }) => void) | undefined; + const initialize = jest.fn((options: any) => { callback = options.callback; }); (window as any).google = { accounts: { id: { - initialize: jest.fn((options: any) => { callback = options.callback; }), + initialize, renderButton: jest.fn((host: HTMLElement) => { const button = document.createElement('button'); button.textContent = 'Continue with Google'; @@ -172,6 +173,7 @@ describe('LoginPage', () => { await waitFor(() => expect(mockedApi.post).toHaveBeenCalledWith('/auth/google/exchange', { token: 'synthetic-google-token', rememberMe: true })); await waitFor(() => expect(mockNavigate).toHaveBeenCalledWith('/dashboard', { replace: true })); + expect(initialize).toHaveBeenCalledTimes(1); expect(screen.queryByText(/create your account automatically/i)).not.toBeInTheDocument(); });