feat: google sso

[akiva10b]

No description provided.

[gitvelocity-reviewer]

📊 Code Quality Score: 28/100

46 × 0.6 = 27.6, rounded to 28

Category	Score	Factors
🔭 Scope	11/20	10 files across auth, API, UI, iOS/Android config, native libraries, env config; single feature but cross-cutting; no new public endpoints (backend changes are out of repo)
🏗️ Architecture	8/20	New native library dependencies with platform-conditional imports; UI component (AppleButton) exported from API module is a boundary violation; platform guard pattern is correct
⚙️ Implementation	10/20	Async OAuth flows with cancellation handling, platform guards, JWT token management, error handling for multiple failure modes; implementation is straightforward but has several correctness issues
⚠️ Risk	12/20	Auth changes are inherently high-risk; hardcoded POC URL would break all API calls; hardcoded OAuth client ID in plist; hard throw on missing env var crashes app at startup; no feature flag; JWT stored in AsyncStorage
✅ Quality	3/15	No tests for any new logic; thorough spec documentation in agent-os/specs; multiple bugs identified including production URL left in, console.log of auth data, empty email passed to onLoginSuccess
🔒 Perf / Security	2/5	credentials: 'omit' correctly prevents cookie leakage; cancellation handling prevents error noise; sensitive auth response logged to console; no rate limiting or retry logic

_{Scored by GitVelocity · How are scores calculated?}