# Google Sign-In Setup

**Time: ~10 minutes. Cost: free. This is the one to do first** — it's the easiest, and the majority of your neighbors already have a Google account.

---

## Step 1 — Create the Google Cloud project

1. Go to **https://console.cloud.google.com/**
2. Sign in with the Google account that should *own* this (use a neighborhood account if you have one — not a personal account you might lose access to).
3. Click the **project dropdown** at the top → **New Project**.
4. Name: `Paddlers Cove Community Site`
5. Click **Create**, then make sure the new project is selected.

---

## Step 2 — Configure the OAuth consent screen

1. Left nav → **APIs & Services** → **OAuth consent screen**
2. User type: **External** → **Create**
3. Fill in:
   - **App name:** `Paddlers Cove`
   - **User support email:** your email
   - **App logo:** upload `public/assets/img/logo.svg` (convert to PNG, 120×120)
   - **Application home page:** `https://paddlerscove.org`
   - **Privacy policy link:** `https://paddlerscove.org/privacy`
   - **Terms of service link:** `https://paddlerscove.org/terms`
   - **Authorized domains:** `paddlerscove.org`
   - **Developer contact:** your email
4. **Save and Continue**

### Scopes
5. Click **Add or Remove Scopes** and select exactly these three:
   - `openid`
   - `.../auth/userinfo.email`
   - `.../auth/userinfo.profile`
6. **Save and Continue**

> These are "non-sensitive" scopes, which is the whole point: **no Google verification review required**. The moment you add anything else (Drive, Contacts, Calendar of the *user*), Google makes you go through a verification process that takes weeks. Don't.

### Test users
7. While in **Testing** mode only the emails you list here can sign in. Add your own email.
8. **Save and Continue** → **Back to Dashboard**

### Publish
9. Click **Publish App** → **Confirm**. Because you only requested non-sensitive scopes, it goes live immediately with no review.

---

## Step 3 — Create the OAuth client ID

1. **APIs & Services** → **Credentials** → **+ Create Credentials** → **OAuth client ID**
2. Application type: **Web application**
3. Name: `Paddlers Cove Web`
4. **Authorized JavaScript origins** → Add URI:
   ```
   https://paddlerscove.org
   ```
5. **Authorized redirect URIs** → Add URI — this must match *exactly*, including https and no trailing slash:
   ```
   https://paddlerscove.org/auth/google/callback
   ```
6. If you're testing locally first, also add:
   ```
   http://localhost:8000
   http://localhost:8000/auth/google/callback
   ```
7. Click **Create**.

---

## Step 4 — Copy credentials into `.env`

A dialog shows your **Client ID** and **Client secret**. Copy both into `.env`:

```ini
GOOGLE_CLIENT_ID=123456789012-abcdefghijklmnop.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxxxxxx
```

The "Continue with Google" button appears automatically once both values are present — `ProviderFactory::enabled()` checks for them.

---

## Step 5 — Test

1. Visit `https://paddlerscove.org/login`
2. Click **Continue with Google**
3. Approve the consent screen
4. You should land on `/register/address`

---

## Troubleshooting

| Error | Cause | Fix |
|---|---|---|
| `redirect_uri_mismatch` | Redirect URI doesn't match character-for-character | Compare http vs https, trailing slash, www vs non-www |
| `Access blocked: not verified` | Still in Testing mode | Publish the app, or add the email as a test user |
| `invalid_client` | Wrong secret, or extra whitespace in `.env` | Re-copy; make sure no quotes or trailing spaces |
| Lands back at `/login` with "session expired" | Session cookie lost on redirect | Confirm `SameSite=Lax` (already set) and that you're on HTTPS |

---

## Security notes

- Rotate the client secret if it's ever committed to git. `.gitignore` already excludes `.env`.
- Google will email the project owner if the secret leaks publicly — another reason to own the project with an account you actually monitor.