signinwith 1.2.0 → 1.2.1

package/index.js

@@ -1,7 +1,37 @@
 export const verifySigninGoogle = async (config, verificationData) => {
-	const res = await fetch(`https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=${verificationData.code}`);
+	if (!verificationData?.code) return { success: false, error: 'Missing Google authorization code' };
+	if (!config?.clientId || !config?.clientSecret) return { success: false, error: 'Google clientId and clientSecret are required' };
+
+	const params = new URLSearchParams();
+	params.append('code', verificationData.code);
+	params.append('client_id', config.clientId);
+	params.append('client_secret', config.clientSecret);
+	params.append('redirect_uri', new URL(config.redirectUri || 'https://example.com').origin);
+	params.append('grant_type', 'authorization_code');
+
+	const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+		method: 'POST',
+		headers: {
+			'Content-Type': 'application/x-www-form-urlencoded',
+		},
+		body: params,
+	});
+
+	const token = await tokenResponse.json();
+	if (!tokenResponse.ok || token.error) {
+		return { success: false, error: token.error_description || 'Failed to exchange Google code for token' };
+	}
+
+	const res = await fetch(`https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=${token.id_token}`);
 	const payload = await res.json();
-	if (payload.aud !== config.clientId) return { success: false, error: 'Mismatch in clientID and "aud" value.' };
+	
+	if (payload.error) {
+		return { success: false, error: payload.error_description || 'Invalid Google token' };
+	}
+	if (payload.aud !== config.clientId) {
+		return { success: false, error: 'Mismatch in clientID and "aud" value.' };
+	}
+	
 	return payload.email ? { success: true, email: payload.email } : { success: false, error: 'Email not found' };
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "signinwith",
-	"version": "1.2.0",
+	"version": "1.2.1",
 	"description": "Simple and straightforward library for sign in / sign up with thirdparty oAuth services like Google, Facebook, Apple, Discord...",
 	"main": "index.js",
 	"scripts": {

package/react.jsx

@@ -84,6 +84,7 @@ export function SignInWithGoogle({ service, onSignin, onError }) {
 				client_id: service.clientId,
 				scope: "openid email profile",
 				ux_mode: "popup",
+				redirect_uri: service.redirectUri,
 				callback: (res) => {
 					// res.code is the authorization code (send to backend)
 					if (!res?.code) return onError?.("No auth code received from Google.");

package/readme.md

@@ -31,6 +31,7 @@ function App() {
 	const services = {
 		google: {
 			clientId: 'YOUR_GOOGLE_CLIENT_ID.apps.googleusercontent.com',
+			redirectUri: 'https://yourdomain.com/redirect-oauth.html', // Need to match your OAuth origin settings
 		},
 		facebook: {
 			appId: 'YOUR_FACEBOOK_APP_ID',
@@ -105,6 +106,8 @@ app.use(express.json());
 const servicesConfig = {
 	google: {
 		clientId: process.env.GOOGLE_CLIENT_ID,
+		clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+		redirectUri: 'https://yourdomain.com/redirect-oauth.html', // Need to match your OAuth origin settings
 	},
 	facebook: {
 		// Facebook verification only needs the access token from the frontend