[kkerti]

Summary

Slice 6 (code half) of the authentication rework (webapps/docs/auth-rework-plan.md, section 6). The identity bridge itself is console-side (decision 27): the oidc.is-auth(-dev) provider gets repointed at Logto at cutover, no data moves.

Hold until the cutover: released editors still open <profileCloudUrl>/authorize for Google sign-in. A tag deploy of this branch breaks that for every pre-rework editor, so it must ship together with the editor release (plan, slice 8).

 src/
-├── routes/authorize/+page.svelte        # GIS hand-off page for the old grid-editor:// credential deep link
-├── lib/components/GoogleAuth.svelte
 ├── lib/stores.ts                          # skip signInWithCredential when the editor re-posts the same token
-└── app.d.ts                               # declare var google
 .github/workflows/*                        # PUBLIC_GOOGLE_CLIENT_ID removed
 README.md                                  # auth note, decision 27, link to the plan

Evidence

• grep -rni "authorize\|GoogleAuth\|GOOGLE_CLIENT" src empty; builds (build, build:webcomponent) pass; check and eslint error counts drop by the two deleted-file errors and gain none.
• Inside the web editor (grid-editor feat/auth-logto, VITE_PROFILE_CLOUD_URL pointing at this build) the posted Logto token reaches signInWithCredential with providerId=oidc.is-auth-dev, sub = fixture uid, no nonce; Firebase answers INVALID_IDP_RESPONSE issuer mismatch, which is the expected state until the console provider is repointed.
• Re-post guard: 11-step sequence with the real Firebase SDK and mocked Google endpoints; re-posted identical tokens skip, refreshed/after-logout/rejected-then-retried tokens sign in.

Merge Danger

Door: one-way for released editors (Google sign-in path removed).

Blast Radius: sign-in from pre-rework editors once the tag deploy runs. Rehearsal note: the editor mounts <profile-cloud-prod> for a local URL, so build with WEB_COMPONENT_NAME=profile-cloud-prod PUBLIC_APP_ENV=development npm run build:webcomponent.

🤖 Generated with Claude Code