@robodev-ai/runtime 0.2.0 → 0.4.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@robodev-ai/runtime",
-  "version": "0.2.0",
-  "description": "Robodev project runtime — deploy-file classification, esbuild compile, module loading, schema push, route matching, OpenAPI, handler invocation, and Robodev Auth. Shared by hosted Starbase and `robodev dev`.",
+  "version": "0.4.0",
+  "description": "Robodev project runtime — deploy-file classification, esbuild compile, module loading, schema push, route matching, OpenAPI, handler invocation, Robodev Auth, the socket engine, and local file storage. Shared by hosted Starbase and `robodev dev`.",
   "type": "module",
   "license": "MIT",
   "repository": {

package/src/auth-core.ts

@@ -267,3 +267,52 @@ export async function revokeRefresh(db: AuthQueryable, refreshToken: string): Pr
     hashToken(refreshToken),
   ]);
 }
+
+export type GoogleUpsertResult =
+  | { user: AuthRow; created: boolean; updated: boolean; previousName?: string | null }
+  | "signup_disabled";
+
+export async function upsertGoogleUser(
+  pool: AuthQueryable,
+  input: { email: string; name: string | null; subject: string },
+  options: { allowSignups: boolean } = { allowSignups: true },
+): Promise<GoogleUpsertResult> {
+  await ensureAuthSchema(pool);
+  const email = input.email.toLowerCase();
+  const existing = await pool.query<AuthRow>(
+    `SELECT id, email, password_hash, name, google_subject FROM robodev_auth.users WHERE email = $1`,
+    [email],
+  );
+  const row = existing.rows[0];
+  if (row) {
+    const previousName = row.name;
+    const nextName = input.name && input.name !== row.name ? input.name : row.name;
+    if (nextName !== row.name || row.google_subject !== input.subject) {
+      await pool.query(
+        `UPDATE robodev_auth.users SET name = $1, google_subject = $2 WHERE id = $3`,
+        [nextName, input.subject, row.id],
+      );
+      return {
+        user: { ...row, name: nextName, google_subject: input.subject },
+        created: false,
+        updated: true,
+        previousName,
+      };
+    }
+    return { user: row, created: false, updated: false };
+  }
+  if (!options.allowSignups) return "signup_disabled";
+  const created: AuthRow = {
+    id: id("usr"),
+    email,
+    password_hash: null,
+    name: input.name,
+    google_subject: input.subject,
+  };
+  await pool.query(
+    `INSERT INTO robodev_auth.users (id, email, password_hash, name, google_subject)
+     VALUES ($1, $2, $3, $4, $5)`,
+    [created.id, created.email, created.password_hash, created.name, created.google_subject],
+  );
+  return { user: created, created: true, updated: false };
+}

package/src/index.ts

@@ -2,7 +2,7 @@
  * `@robodev-ai/runtime` — the project runtime shared by hosted Starbase deploys and the
  * offline `robodev dev` loop: deploy-file classification, the esbuild compile, module
  * loading, schema push, route matching, OpenAPI, handler invocation, Robodev Auth,
- * and the offline `robodev dev` jobs engine.
+ * the socket engine, local file storage, and the offline `robodev dev` jobs engine.
  */
 
 export {
@@ -166,8 +166,10 @@ export {
   toAuthUser,
   updateUserPassword,
   updateUserProfile,
+  upsertGoogleUser,
   type AuthQueryable,
   type AuthRow,
+  type GoogleUpsertResult,
   type NonceType,
 } from "./auth-core.js";
 
@@ -222,3 +224,73 @@ export {
   type LocalJobsEngineOptions,
   type LocalJobsGeneration,
 } from "./local-jobs.js";
+
+export {
+  MAX_PROJECT_SOCKETS,
+  MAX_SOCKET_PAYLOAD_BYTES,
+  SOCKET_CLOSE_INVALID,
+  SOCKET_CLOSE_POLICY,
+  SOCKET_CLOSE_RESTART,
+  SOCKET_CLOSE_TOO_BIG,
+  SOCKET_IDLE_PING_MS,
+  assertKnownSocket,
+  attachProjectSocket,
+  bindSocketSession,
+  closeProjectSockets,
+  createProjectSocketsClient,
+  detachProjectSocket,
+  dispatchSocketsSend,
+  joinSocketRoom,
+  leaveSocketRoom,
+  parseSocketMessage,
+  projectSocketCount,
+  sendToSocketName,
+  sendToSocketRoom,
+  setProjectSocketNames,
+  socketAuthDisplay,
+  stringifySocketPayload,
+  type BindSocketSessionInput,
+  type LiveConn,
+  type SocketSessionHelpers,
+  type SocketWire,
+} from "./sockets.js";
+
+export {
+  DEFAULT_LIST_LIMIT,
+  MAX_LIST_LIMIT,
+  MAX_OBJECT_BYTES,
+  PRESIGN_GET_DEFAULT,
+  PRESIGN_GET_MAX,
+  assertObjectSize,
+  clampStorageExpiresIn,
+  mintStorageServeToken,
+  parseLogicalKey,
+  storageListQuerySchema,
+  verifyStorageServeToken,
+} from "./storage-rules.js";
+
+export {
+  createLocalStorageClient,
+  ensureStorageSchema,
+  resolveLocalObject,
+  type LocalObjectRow,
+  type LocalStorageClientOptions,
+  type StorageQueryable,
+} from "./local-storage.js";
+
+export {
+  LOCAL_DEV_IDENTITY_AUD,
+  LOCAL_DEV_IDENTITY_TYP,
+  assertLocalAppRedirectUri,
+  assertLocalBrokerRedirectUri,
+  brokerDevStartUrl,
+  exchangeLocalGoogleCode,
+  localGoogleAuthorizeUrl,
+  localGoogleCallbackUri,
+  projectGoogleOverrideMode,
+  redirectWithQuery,
+  resetLocalDevAssertionReplayForTests,
+  signLocalGoogleState,
+  verifyLocalDevIdentityAssertion,
+  verifyLocalGoogleState,
+} from "./local-google.js";

package/src/local-auth.test.ts

@@ -1,7 +1,15 @@
 import assert from "node:assert/strict";
 import test from "node:test";
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT } from "jose";
 import { handleLocalAuth, isLocalAuthPath, resolveLocalUser } from "./local-auth.js";
-import type { AuthQueryable } from "./auth-core.js";
+import { upsertGoogleUser, type AuthQueryable } from "./auth-core.js";
+import {
+  LOCAL_DEV_IDENTITY_AUD,
+  LOCAL_DEV_IDENTITY_TYP,
+  resetLocalDevAssertionReplayForTests,
+  signLocalGoogleState,
+} from "./local-google.js";
+import { verifyProjectUserToken } from "./project-jwt.js";
 
 type UserRow = {
   id: string;
@@ -44,15 +52,24 @@ class MemoryAuthDb implements AuthQueryable {
       return rows(row ? [row] : []);
     }
     if (s.startsWith("INSERT INTO robodev_auth.users")) {
+      const hasGoogle = s.includes("google_subject");
       this.users.push({
         id: String(params[0]),
         email: String(params[1]),
         password_hash: (params[2] as string | null) ?? null,
         name: (params[3] as string | null) ?? null,
-        google_subject: null,
+        google_subject: hasGoogle ? ((params[4] as string | null) ?? null) : null,
       });
       return rows([]);
     }
+    if (s.includes("UPDATE robodev_auth.users SET name = $1, google_subject")) {
+      const user = this.users.find((row) => row.id === params[2]);
+      if (user) {
+        user.name = params[0] as string | null;
+        user.google_subject = params[1] as string | null;
+      }
+      return rows([]);
+    }
     if (s.includes("UPDATE robodev_auth.users SET name = $1, email = $2")) {
       const user = this.users.find((row) => row.id === params[2]);
       if (user) {
@@ -133,6 +150,8 @@ function setup() {
     projectId: "prj-local",
     jwtSecret: "test-secret",
     deliverCode: (input: Delivered) => delivered.push(input),
+    listenOrigin: "http://localhost:4000",
+    brokerBaseUrl: "https://robodev.povio.dev",
   };
   return { db, delivered, options };
 }
@@ -383,14 +402,251 @@ test("forgot password resets and the new password logs in", async () => {
   assert.equal(login.status, 200);
 });
 
-test("google sign-in points at hosted Starbase", async () => {
+test("google start 302s to the Starbase broker", async () => {
+  const { options } = setup();
+  const result = await handleLocalAuth(
+    {
+      method: "GET",
+      pathname: "/api/user/auth/google",
+      query: { redirect_uri: "http://localhost:5173/app" },
+    },
+    options,
+  );
+  assert.equal(result.status, 302);
+  const location = new URL(String(result.headers?.Location));
+  assert.equal(location.origin, "https://robodev.povio.dev");
+  assert.equal(location.pathname, "/internal/auth/google/dev");
+  assert.equal(
+    location.searchParams.get("callback_uri"),
+    "http://localhost:4000/api/user/auth/google/callback",
+  );
+  assert.equal(location.searchParams.get("redirect_uri"), "http://localhost:5173/app");
+});
+
+test("google start rejects a public redirect_uri", async () => {
+  const { options } = setup();
+  const result = await handleLocalAuth(
+    {
+      method: "GET",
+      pathname: "/api/user/auth/google",
+      query: { redirect_uri: "https://evil.example/app" },
+    },
+    options,
+  );
+  assert.equal(result.status, 400);
+  assert.equal(result.body.code, "invalid_redirect_uri");
+});
+
+test("google start allows https loopback app redirect", async () => {
+  const { options } = setup();
+  const result = await handleLocalAuth(
+    {
+      method: "GET",
+      pathname: "/api/user/auth/google",
+      query: { redirect_uri: "https://localhost:5173/app" },
+    },
+    options,
+  );
+  assert.equal(result.status, 302);
+  const location = new URL(String(result.headers?.Location));
+  assert.equal(location.searchParams.get("redirect_uri"), "https://localhost:5173/app");
+});
+
+test("google override requires both project .env keys", async () => {
+  const { options } = setup();
+  const one = await handleLocalAuth(
+    {
+      method: "GET",
+      pathname: "/api/user/auth/google",
+      query: { redirect_uri: "http://localhost:5173/app" },
+    },
+    { ...options, googleClientId: "only-id" },
+  );
+  assert.equal(one.status, 503);
+  assert.equal(one.body.code, "google_oauth_unconfigured");
+
+  const both = await handleLocalAuth(
+    {
+      method: "GET",
+      pathname: "/api/user/auth/google",
+      query: { redirect_uri: "http://localhost:5173/app" },
+    },
+    { ...options, googleClientId: "id", googleClientSecret: "secret" },
+  );
+  assert.equal(both.status, 302);
+  const location = new URL(String(both.headers?.Location));
+  assert.equal(location.hostname, "accounts.google.com");
+  assert.equal(
+    location.searchParams.get("redirect_uri"),
+    "http://localhost:4000/api/user/auth/google/callback",
+  );
+  assert.equal(location.searchParams.get("client_id"), "id");
+});
+
+test("google broker assertion upserts google_subject and issues prj-local tokens", async () => {
+  resetLocalDevAssertionReplayForTests();
+  const { db, options } = setup();
+  const { privateKey, publicKey } = await generateKeyPair("EdDSA", { crv: "Ed25519" });
+  const jwk = await exportJWK(publicKey);
+  const kid = "test-kid";
+  const now = Math.floor(Date.now() / 1000);
+  const assertion = await new SignJWT({
+    typ: LOCAL_DEV_IDENTITY_TYP,
+    email: "G@B.com",
+    name: "Gail",
+    google_subject: "sub-9",
+    callback_uri: "http://localhost:4000/api/user/auth/google/callback",
+    redirect_uri: "http://localhost:5173/app",
+  })
+    .setProtectedHeader({ alg: "EdDSA", typ: "JWT", kid })
+    .setIssuer("https://robodev.povio.dev")
+    .setAudience(LOCAL_DEV_IDENTITY_AUD)
+    .setJti("jti-1")
+    .setIssuedAt(now)
+    .setExpirationTime(now + 120)
+    .sign(privateKey);
+
+  const identityJwks = createLocalJWKSet({ keys: [{ ...jwk, kid, use: "sig", alg: "EdDSA" }] });
+
+  try {
+    const result = await handleLocalAuth(
+      {
+        method: "GET",
+        pathname: "/api/user/auth/google/callback",
+        query: { assertion },
+      },
+      { ...options, identityJwks },
+    );
+    assert.equal(result.status, 302);
+    const location = new URL(String(result.headers?.Location));
+    assert.equal(location.origin + location.pathname, "http://localhost:5173/app");
+    const accessToken = location.searchParams.get("accessToken");
+    const refreshToken = location.searchParams.get("refreshToken");
+    assert.ok(accessToken);
+    assert.ok(refreshToken);
+    const user = await verifyProjectUserToken(accessToken, "prj-local", "test-secret");
+    assert.equal(user.email, "g@b.com");
+    assert.equal(db.users[0]?.google_subject, "sub-9");
+    assert.equal(db.users[0]?.email, "g@b.com");
+
+    const replay = await handleLocalAuth(
+      {
+        method: "GET",
+        pathname: "/api/user/auth/google/callback",
+        query: { assertion },
+      },
+      { ...options, identityJwks },
+    );
+    assert.equal(replay.status, 400);
+    assert.equal(replay.body.code, "invalid_assertion");
+  } finally {
+    resetLocalDevAssertionReplayForTests();
+  }
+});
+
+test("google broker assertion rejects a mismatched callback_uri", async () => {
+  resetLocalDevAssertionReplayForTests();
+  const { options } = setup();
+  const { privateKey, publicKey } = await generateKeyPair("EdDSA", { crv: "Ed25519" });
+  const jwk = await exportJWK(publicKey);
+  const now = Math.floor(Date.now() / 1000);
+  const assertion = await new SignJWT({
+    typ: LOCAL_DEV_IDENTITY_TYP,
+    email: "a@b.com",
+    name: "A",
+    google_subject: "sub",
+    callback_uri: "http://localhost:4001/api/user/auth/google/callback",
+    redirect_uri: "http://localhost:5173/app",
+  })
+    .setProtectedHeader({ alg: "EdDSA", typ: "JWT", kid: "k" })
+    .setIssuer("https://robodev.povio.dev")
+    .setAudience(LOCAL_DEV_IDENTITY_AUD)
+    .setJti("jti-mismatch")
+    .setIssuedAt(now)
+    .setExpirationTime(now + 120)
+    .sign(privateKey);
+
+  try {
+    const result = await handleLocalAuth(
+      {
+        method: "GET",
+        pathname: "/api/user/auth/google/callback",
+        query: { assertion },
+      },
+      {
+        ...options,
+        identityJwks: createLocalJWKSet({ keys: [{ ...jwk, kid: "k", use: "sig", alg: "EdDSA" }] }),
+      },
+    );
+    assert.equal(result.status, 400);
+    assert.equal(result.body.code, "invalid_assertion");
+  } finally {
+    resetLocalDevAssertionReplayForTests();
+  }
+});
+
+test("google override callback upserts and 302s tokens", async () => {
+  const { db, options } = setup();
+  const state = await signLocalGoogleState("test-secret", "http://localhost:5173/app");
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (url: string | URL | Request) => {
+    const href = String(url);
+    if (href.includes("oauth2.googleapis.com/token")) {
+      return new Response(JSON.stringify({ access_token: "tok" }), { status: 200 });
+    }
+    if (href.includes("userinfo")) {
+      return new Response(JSON.stringify({ id: "g-2", email: "o@b.com", name: "O" }), {
+        status: 200,
+      });
+    }
+    throw new Error(`unexpected fetch ${href}`);
+  }) as typeof fetch;
+
+  try {
+    const result = await handleLocalAuth(
+      {
+        method: "GET",
+        pathname: "/api/user/auth/google/callback",
+        query: { code: "ok", state },
+      },
+      { ...options, googleClientId: "id", googleClientSecret: "secret" },
+    );
+    assert.equal(result.status, 302);
+    const location = new URL(String(result.headers?.Location));
+    assert.ok(location.searchParams.get("accessToken"));
+    assert.equal(db.users[0]?.email, "o@b.com");
+    assert.equal(db.users[0]?.google_subject, "g-2");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("google callback error 302s to a loopback app redirect", async () => {
   const { options } = setup();
   const result = await handleLocalAuth(
-    { method: "GET", pathname: "/api/user/auth/google", query: { redirect_uri: "http://x" } },
+    {
+      method: "GET",
+      pathname: "/api/user/auth/google/callback",
+      query: { error: "google_oauth_failed", redirect_uri: "http://localhost:5173/app" },
+    },
     options,
   );
-  assert.equal(result.status, 503);
-  assert.match(String(result.body.message), /hosted Starbase/);
+  assert.equal(result.status, 302);
+  const location = new URL(String(result.headers?.Location));
+  assert.equal(location.searchParams.get("error"), "google_oauth_failed");
+});
+
+test("two local Auth dbs upsert the same Google email independently", async () => {
+  const a = setup();
+  const b = setup();
+  const first = await upsertGoogleUser(a.db, { email: "same@b.com", name: "S", subject: "sub" });
+  const second = await upsertGoogleUser(b.db, { email: "same@b.com", name: "S", subject: "sub" });
+  assert.notEqual(first, "signup_disabled");
+  assert.notEqual(second, "signup_disabled");
+  if (first === "signup_disabled" || second === "signup_disabled") return;
+  assert.notEqual(first.user.id, second.user.id);
+  assert.equal(a.db.users[0]?.email, "same@b.com");
+  assert.equal(b.db.users[0]?.email, "same@b.com");
 });
 
 test("unknown Auth routes 404", async () => {

package/src/local-auth.ts

@@ -14,12 +14,14 @@ import {
   toAuthUser,
   updateUserPassword,
   updateUserProfile,
+  upsertGoogleUser,
   type AuthQueryable,
 } from "./auth-core.js";
 import {
   forgotCallbackBody,
   forgotRequestBody,
   GENERIC_STATUS_MESSAGE,
+  googleStartQuery,
   loginBody,
   magicConsumeQuery,
   magicGenerateQuery,
@@ -28,11 +30,25 @@ import {
   registerBody,
   statusOk,
 } from "./auth-schemas.js";
+import type { JWTVerifyGetKey } from "jose";
+import {
+  assertLocalAppRedirectUri,
+  brokerDevStartUrl,
+  exchangeLocalGoogleCode,
+  localGoogleAuthorizeUrl,
+  localGoogleCallbackUri,
+  projectGoogleOverrideMode,
+  redirectWithQuery,
+  signLocalGoogleState,
+  verifyLocalDevIdentityAssertion,
+  verifyLocalGoogleState,
+} from "./local-google.js";
 import { bearerToken, verifyProjectUserToken } from "./project-jwt.js";
 
 export type LocalAuthResult = {
   status: number;
   body: Record<string, unknown>;
+  headers?: { Location: string };
 };
 
 export type LocalAuthRequest = {
@@ -52,12 +68,34 @@ export type LocalAuthOptions = {
    * terminal instead of sending mail.
    */
   deliverCode: (input: { to: string; type: string; code: string }) => void;
+  /** `http://localhost:${port}` — never 0.0.0.0. */
+  listenOrigin: string;
+  /** Process-env `STARBASE_URL`, default production. Not the project `.env`. */
+  brokerBaseUrl: string;
+  /** Project-root `.env` only. Both must be set to skip the Starbase broker. */
+  googleClientId?: string;
+  googleClientSecret?: string;
+  /** Test hook: skip the remote JWKS fetch. */
+  identityJwks?: JWTVerifyGetKey;
 };
 
 function fail(status: number, code: string, message?: string): LocalAuthResult {
   return { status, body: { code, ...(message ? { message } : {}) } };
 }
 
+function redirect(location: string): LocalAuthResult {
+  return { status: 302, body: {}, headers: { Location: location } };
+}
+
+function loopbackAppRedirect(raw: string | undefined): string | null {
+  if (!raw) return null;
+  try {
+    return assertLocalAppRedirectUri(raw);
+  } catch {
+    return null;
+  }
+}
+
 /** True for the reserved Auth surface `robodev dev` serves itself. */
 export function isLocalAuthPath(pathname: string): boolean {
   return pathname === "/api/user" || pathname.startsWith("/api/user/");
@@ -80,7 +118,8 @@ export async function resolveLocalUser(
  * Password auth for a single local project: register, login, refresh, magic link,
  * forgot password, and `/api/user/me`. Every operation runs through `auth-core`, the
  * same code hosted Starbase Auth uses, so a local login behaves like a deployed one.
- * Google OAuth and real SMTP stay hosted-only.
+ * Google uses the Starbase identity broker unless the project `.env` has both
+ * `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET`. SMTP still prints to the terminal.
  */
 export async function handleLocalAuth(
   request: LocalAuthRequest,
@@ -192,11 +231,147 @@ export async function handleLocalAuth(
     }
 
     if (method === "GET" && pathname === "/api/user/auth/google") {
-      return fail(
-        503,
-        "google_oauth_disabled",
-        "Google sign-in needs hosted Starbase. Deploy the project to use it.",
+      const q = googleStartQuery.parse(query);
+      let redirectUri: string;
+      try {
+        redirectUri = assertLocalAppRedirectUri(q.redirect_uri);
+      } catch (error) {
+        return fail(
+          400,
+          "invalid_redirect_uri",
+          error instanceof Error ? error.message : "invalid redirect_uri",
+        );
+      }
+      const callbackUri = localGoogleCallbackUri(options.listenOrigin);
+      const override = projectGoogleOverrideMode(
+        options.googleClientId,
+        options.googleClientSecret,
       );
+      if (override === "one") {
+        return fail(
+          503,
+          "google_oauth_unconfigured",
+          "Set both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in the project .env, or unset both.",
+        );
+      }
+      if (override === "both") {
+        const state = await signLocalGoogleState(jwtSecret, redirectUri);
+        return redirect(
+          localGoogleAuthorizeUrl(state, {
+            clientId: options.googleClientId!.trim(),
+            redirectUri: callbackUri,
+          }),
+        );
+      }
+      return redirect(brokerDevStartUrl(options.brokerBaseUrl, { callbackUri, redirectUri }));
+    }
+
+    if (method === "GET" && pathname === "/api/user/auth/google/callback") {
+      const q = query as Record<string, string | undefined>;
+      const callbackUri = localGoogleCallbackUri(options.listenOrigin);
+      if (q.error) {
+        const appRedirect = loopbackAppRedirect(q.redirect_uri);
+        if (appRedirect) {
+          return redirect(redirectWithQuery(appRedirect, { error: q.error }));
+        }
+        return fail(400, "invalid_redirect_uri");
+      }
+      if (q.assertion) {
+        try {
+          const identity = await verifyLocalDevIdentityAssertion(q.assertion, {
+            brokerBaseUrl: options.brokerBaseUrl,
+            callbackUri,
+            jwks: options.identityJwks,
+          });
+          const result = await upsertGoogleUser(
+            db,
+            {
+              email: identity.email,
+              name: identity.name,
+              subject: identity.googleSubject,
+            },
+            { allowSignups: true },
+          );
+          if (result === "signup_disabled") {
+            return fail(400, "signup_disabled");
+          }
+          const tokens = await issueProjectTokenPair(
+            db,
+            projectId,
+            toAuthUser(result.user),
+            jwtSecret,
+          );
+          return redirect(
+            redirectWithQuery(identity.redirectUri, {
+              accessToken: tokens.accessToken,
+              refreshToken: tokens.refreshToken,
+            }),
+          );
+        } catch (error) {
+          const code =
+            error && typeof error === "object" && "code" in error
+              ? String((error as { code: unknown }).code)
+              : "invalid_assertion";
+          const appRedirect = loopbackAppRedirect(q.redirect_uri);
+          if (appRedirect) {
+            return redirect(redirectWithQuery(appRedirect, { error: code }));
+          }
+          return fail(400, code === "invalid_redirect_uri" ? code : "invalid_assertion");
+        }
+      }
+      if (q.code && q.state) {
+        const override = projectGoogleOverrideMode(
+          options.googleClientId,
+          options.googleClientSecret,
+        );
+        if (override !== "both") {
+          return fail(503, "google_oauth_unconfigured");
+        }
+        try {
+          const localState = await verifyLocalGoogleState(jwtSecret, q.state);
+          const redirectUri = assertLocalAppRedirectUri(localState.redirectUri);
+          const profile = await exchangeLocalGoogleCode(q.code, {
+            clientId: options.googleClientId!.trim(),
+            clientSecret: options.googleClientSecret!.trim(),
+            redirectUri: callbackUri,
+          });
+          const result = await upsertGoogleUser(
+            db,
+            {
+              email: profile.email,
+              name: profile.name,
+              subject: profile.subject,
+            },
+            { allowSignups: true },
+          );
+          if (result === "signup_disabled") {
+            return fail(400, "signup_disabled");
+          }
+          const tokens = await issueProjectTokenPair(
+            db,
+            projectId,
+            toAuthUser(result.user),
+            jwtSecret,
+          );
+          return redirect(
+            redirectWithQuery(redirectUri, {
+              accessToken: tokens.accessToken,
+              refreshToken: tokens.refreshToken,
+            }),
+          );
+        } catch (error) {
+          const appRedirect = loopbackAppRedirect(q.redirect_uri);
+          if (appRedirect) {
+            return redirect(redirectWithQuery(appRedirect, { error: "google_oauth_failed" }));
+          }
+          if (error && typeof error === "object" && "code" in error) {
+            const code = String((error as { code: unknown }).code);
+            return fail(400, code, error instanceof Error ? error.message : undefined);
+          }
+          return fail(400, "invalid_assertion", "Google sign-in failed");
+        }
+      }
+      return fail(400, "invalid_assertion");
     }
   } catch (error) {
     if (error instanceof ZodError) {