Add Google Sign-In Authentication

Abierto
  • ¿Algo no está bien?
#126 0 comentarios 0 reacciones 0 asignados Ver en GitHub

@gopikrishna-20 ya está trabajando en esto.

Desde el 17/10/2026.

  • #129 de @gopikrishna-20 — abierto

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
15/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
javascript
Área
authentication, backend, database, frontend, security

Línea de trabajo

Start from the login page and the existing email/password auth flow, then check how GOOGLE_CLIENT_ID configuration is read. The work spans GET /api/auth/config, POST /api/auth/google with token verification, an oauth_identities table with a unique provider index, account-deletion cleanup, and the Cross-Origin-Opener-Policy header. Done means a Google sign-in creates or links a user, the button stays hidden without a Client ID, and failures are handled gracefully. This is multi-subsystem design work, so it suits a maintainer more than a first-timer.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description

Add Google Sign-In to AlphaLearn using Google Identity Services, allowing users to authenticate with their Google accounts instead of relying only on the existing email and password login flow.

Proposed Implementation

Frontend
  • Add a Continue with Google button to the login page.
  • Display the Google Sign-In option only when GOOGLE_CLIENT_ID is configured.
  • Integrate Google Identity Services to obtain the user's ID token.
  • Reuse the existing authentication and redirect flow after successful login.
Backend
  • Add GET /api/auth/config to expose the public Google Client ID.
  • Add POST /api/auth/google to verify Google credentials and authenticate users.
  • Validate the token's signature, issuer, audience, expiration, and verified email claim.
  • Link Google identities to existing accounts with the same email address.
  • Store Google identity references using a hashed provider identifier rather than storing the raw Google subject.
  • Apply rate limiting and handle authentication failures safely.
Database and Security
  • Add an oauth_identities table to associate external identities with AlphaLearn users.
  • Add an index on user_id and enforce uniqueness for provider identities.
  • Clean up OAuth identity records when an account is deleted.
  • Update the Cross-Origin-Opener-Policy header to support Google popup sign-in.
  • Keep OAuth credentials out of source control.

Expected Behavior

  1. Users can sign in using Google from the login page.
  2. New users are registered automatically and redirected to the dashboard.
  3. Existing users can sign in through their linked Google identity.
  4. Existing accounts with matching email addresses are handled without creating duplicate accounts.
  5. Google Sign-In remains hidden when no Client ID is configured.
  6. Authentication failures are handled gracefully.
Lenguaje dominante
HTML
Estrellas
3
Forks
29
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Issues similares

Más issues de Security

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.