# Google login — {{REPO_NAME}}

This repo has a Google OAuth client provisioned by the org — one client spanning local/`/stage`, dev, rc, and
prod. Adding Google login here is **self-serve**: you do not need master-admin help.

## Reach the creds (from SSM — never in git, never printed)
```bash
# Confirm they resolve for your repo (names only, no value):
mmi-cli vault secrets list
# Consume them keyless in a command — injected into its env, never printed (raw `secrets get` was removed, #2844):
mmi-cli vault secrets use GOOGLE_CLIENT_ID -- <cmd>
mmi-cli vault secrets use GOOGLE_CLIENT_SECRET -- <cmd>
```
The canonical keys are the stageless `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET` pair at the project vault
root. The project-admin can manage them for their own repo; runtime and CI read them keylessly. Never bake a secret into an
image or commit it. The remote fileless deploy writes no release `.env`; **do not commit or hand-edit a `.env`**.
The only `.env` you may create is the gitignored one `/stage` makes from `.env.example` for local dev.

## The one rule that makes every environment work
Build the OAuth `redirect_uri` from the **incoming request** — never a hardcoded base URL:
- callback path: `/api/auth/callback`
- derive scheme + host from `X-Forwarded-Proto` / `X-Forwarded-Host` (set by the Caddy proxy), falling back
  to the `Host` header.

The client's loopback redirect URIs are registered **port-agnostic**, so any local port works; dev/rc/prod
URIs are registered for both `mutatismutandis.co` and `mutmut.co`, so the deploy train works unchanged.

## Reference implementation + full guide
Inspect this repo's expected URIs and confirm the client is port-agnostic:
```bash
mmi-cli vault org oauth plan      # the canonical JS origins + redirect URIs + SSM cred params
mmi-cli vault org oauth verify    # probes an arbitrary :9123 loopback — no redirect_uri_mismatch = good
```