fix: Firebase Sync

Author: devohmycode

FirebaseSync.cs

@@ -167,6 +167,7 @@ var s when s.StartsWith("WEAK_PASSWORD") => Lang.T("firebase_weak_password"),
         if (!IsConfigured) return (false, Lang.T("firebase_not_configured"));
         if (!RuntimeSecrets.TryGetGoogleClientId(out var googleClientId))
             return (false, Lang.T("firebase_google_not_configured"));
+        RuntimeSecrets.TryGetGoogleClientSecret(out var googleClientSecret);
         try
         {
             // Generate PKCE code verifier + challenge
@@ -227,6 +228,7 @@ var s when s.StartsWith("WEAK_PASSWORD") => Lang.T("firebase_weak_password"),
             {
                 ["code"] = code,
                 ["client_id"] = googleClientId,
+                ["client_secret"] = googleClientSecret ?? "",
                 ["redirect_uri"] = redirectUri,
                 ["grant_type"] = "authorization_code",
                 ["code_verifier"] = codeVerifier
@@ -236,7 +238,11 @@ var s when s.StartsWith("WEAK_PASSWORD") => Lang.T("firebase_weak_password"),
 
             if (!tokenResponse.IsSuccessStatusCode)
             {
-                return (false, $"Erreur token Google: {tokenResponse.StatusCode}");
+                var detail = await FormatGoogleOAuthTokenErrorAsync(tokenResponse);
+                return (false,
+                    string.IsNullOrEmpty(detail)
+                        ? $"Erreur token Google: {tokenResponse.StatusCode}"
+                        : $"Erreur token Google: {tokenResponse.StatusCode} — {detail}");
             }
 
             var tokenJson = await tokenResponse.Content.ReadFromJsonAsync<JsonElement>();
@@ -265,6 +271,31 @@ var s when s.StartsWith("WEAK_PASSWORD") => Lang.T("firebase_weak_password"),
         catch (Exception ex) { return (false, ex.Message); }
     }
 
+    /// <summary>Google returns JSON: error, error_description (e.g. redirect_uri_mismatch).</summary>
+    private static async Task<string> FormatGoogleOAuthTokenErrorAsync(HttpResponseMessage response)
+    {
+        try
+        {
+            var text = await response.Content.ReadAsStringAsync();
+            if (string.IsNullOrWhiteSpace(text))
+                return "";
+
+            using var doc = JsonDocument.Parse(text);
+            var root = doc.RootElement;
+            var err = root.TryGetProperty("error", out var e) ? e.GetString() : null;
+            var desc = root.TryGetProperty("error_description", out var d) ? d.GetString() : null;
+            if (!string.IsNullOrEmpty(desc))
+                return string.IsNullOrEmpty(err) ? desc : $"{err}: {desc}";
+            if (!string.IsNullOrEmpty(err))
+                return err;
+            return text.Length > 200 ? text[..200] + "…" : text;
+        }
+        catch
+        {
+            return "";
+        }
+    }
+
     private static int FindFreePort()
     {
         var listener = new System.Net.Sockets.TcpListener(IPAddress.Loopback, 0);

RuntimeSecrets.cs

@@ -7,6 +7,7 @@ public static class RuntimeSecrets
     private const string FirebaseUrlEnv = "NOTEUI_FIREBASE_URL";
     private const string FirebaseApiKeyEnv = "NOTEUI_FIREBASE_API_KEY";
     private const string GoogleClientIdEnv = "NOTEUI_GOOGLE_CLIENT_ID";
+    private const string GoogleClientSecretEnv = "NOTEUI_GOOGLE_CLIENT_SECRET";
     private const string BundledConfigFileName = "firebase.public.json";
 
     public static bool TryGetFirebaseConfig(out string firebaseUrl, out string firebaseApiKey)
@@ -33,25 +34,35 @@ public static bool TryGetGoogleClientId(out string googleClientId)
         return !string.IsNullOrWhiteSpace(googleClientId);
     }
 
-    private static (string FirebaseUrl, string FirebaseApiKey, string GoogleClientId) LoadBundledConfig()
+    public static bool TryGetGoogleClientSecret(out string googleClientSecret)
+    {
+        var bundled = LoadBundledConfig();
+        googleClientSecret = FirstNonEmpty(
+            Environment.GetEnvironmentVariable(GoogleClientSecretEnv),
+            bundled.GoogleClientSecret);
+        return !string.IsNullOrWhiteSpace(googleClientSecret);
+    }
+
+    private static (string FirebaseUrl, string FirebaseApiKey, string GoogleClientId, string GoogleClientSecret) LoadBundledConfig()
     {
         try
         {
             var configPath = Path.Combine(AppContext.BaseDirectory, BundledConfigFileName);
             if (!File.Exists(configPath))
-                return ("", "", "");
+                return ("", "", "", "");
 
             using var doc = JsonDocument.Parse(File.ReadAllText(configPath));
             var root = doc.RootElement;
 
             return (
                 GetString(root, "firebaseUrl"),
                 GetString(root, "firebaseApiKey"),
-                GetString(root, "googleClientId"));
+                GetString(root, "googleClientId"),
+                GetString(root, "googleClientSecret"));
         }
         catch
         {
-            return ("", "", "");
+            return ("", "", "", "");
         }
     }