Bluecams/02_Google_OAuth.txt at main · LilToreyFTW/Bluecams · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
BLUECAMS — GOOGLE OAUTH AUTHENTICATION UPGRADE

Add real Google OAuth / OpenID Connect to BlueCams.

Provide Continue with Google plus optional email/password authentication. The flow is:
BlueCams → Google authorization → account selection/authentication → OAuth callback → server validation → find/create BlueCams account → create BlueCams session → enter onboarding/app.

Do not trust frontend Google profile data as authentication proof. Request minimum identity scopes and do not retain Google access tokens unless genuinely required.

FIRST-TIME USERS
Create required account records and route new users to BlueCams onboarding. A Google display name must not automatically become the permanent unique BlueCams username.

DATA MODEL
Support users, provider accounts, sessions, verification tokens and profiles. Associate provider="google" and provider account ID with BlueCams' immutable internal user ID. Do not use email as the primary key.

SECURITY
Use secure/HttpOnly cookies where appropriate, SameSite, HTTPS, expiration and server-side authorization. Authenticate WebSocket connections from the BlueCams session rather than client-submitted user IDs.

ENVIRONMENT
Use GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, AUTH_SECRET, APP_URL and DATABASE_URL as server-side environment variables. Generate .env.example with placeholders only. Never expose GOOGLE_CLIENT_SECRET client-side.

CALLBACKS
Support local and production authorized callback URLs and document the exact URLs produced by the chosen auth library.

ACCOUNT SETTINGS
Show connected Google account status and secure linking/unlinking without allowing users to accidentally remove their final authentication method.

LOGOUT
Invalidate the BlueCams session, disconnect realtime state, remove presence/matchmaking, clean active WebRTC state and return to the public experience.

Moderation must reference immutable BlueCams IDs so changing a Google name/avatar/email cannot evade moderation.

Test the complete OAuth flow end-to-end rather than stopping after rendering a Google button.