chore(auth): remove the /authorize page and Google button — hold until auth cutover

.github/workflows/firebase-hosting-commit-prod.yml

@@ -21,7 +21,6 @@ jobs:
           touch .env
           echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env
           echo PUBLIC_APP_ENV=production >> .env
-          echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_PROD }} >> .env
           echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env
       - run: npm ci && npx svelte-kit sync && npm run build && npm run build:webcomponent
         env:

.github/workflows/firebase-hosting-pull-request-dev.yml

@@ -19,7 +19,6 @@ jobs:
           touch .env
           echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env
           echo PUBLIC_APP_ENV=development >> .env
-          echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_DEV }} >> .env
            echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env
       - run: npm ci && npx svelte-kit sync && npm run build && npm run build:webcomponent
         env:

.github/workflows/firebase-hosting-tag-prod.yml

@@ -20,7 +20,6 @@ jobs:
           touch .env
           echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env
           echo PUBLIC_APP_ENV=production >> .env  
-          echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_PROD }} >> .env
           echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env
       - run: npm ci && npx svelte-kit sync && npm run build && npm run build:webcomponent
         env:

.github/workflows/npm-publish.yml

@@ -22,7 +22,6 @@ jobs:
           touch .env
           echo PUBLIC_COMMIT_HASH=$(git log --format="%h" -n 1) >> .env
           echo PUBLIC_APP_ENV=production >> .env
-          echo PUBLIC_GOOGLE_CLIENT_ID=${{ secrets.PUBLIC_GOOGLE_CLIENT_ID_PROD }} >> .env
           echo PUBLIC_CREATION_DATE=$(git log --format="%cd" --date=format:'%Y-%m-%d' -1) >> .env
       - run: npm ci && npx svelte-kit sync && npm run build:webcomponent
         env:

README.md

@@ -36,3 +36,9 @@ npm run build
 You can preview the production build with `npm run preview`.
 
 > To deploy your app, you may need to install an [adapter](https://kit.svelte.dev/docs/adapters) for your target environment.
+
+## Authentication
+
+Profile Cloud has no sign-in UI. The editor posts `{ event, providerId: "oidc", idToken }` into the web component, and `src/lib/stores.ts` signs that token into Firebase through the `oidc.is-auth` (production) or `oidc.is-auth-dev` (development) provider.
+
+The identity bridge is console-side: those providers point at the identity provider's issuer and the `grid-editor` client id, which keeps every Firebase uid without any code here. The provider is Keycloak (decision 36; this branch was rehearsed against Logto), with the issuer in the form `https://<host>/realms/intech`. See decision 27 in the [authentication rework plan](https://github.com/intechstudio/webapps/blob/main/docs/auth-rework-plan.md).

src/app.d.ts

@@ -9,6 +9,4 @@ declare global {
   }
 }
 
-declare var google: any;
-
 export {};

src/lib/stores.ts

@@ -19,6 +19,8 @@ function createUserAccountService() {
     };
   });
 
+  let signedInIdToken: string | undefined;
+
   async function authenticateUser(credential: {
     event?: string;
     providerId?: string;
@@ -34,6 +36,10 @@ function createUserAccountService() {
       signOut(firebaseAuth);
       return;
     }
+    // the editor re-posts the same token on remount; a refreshed one still signs in
+    if (firebaseAuth.currentUser && credential.idToken === signedInIdToken) {
+      return;
+    }
     const provider = new OAuthProvider(
       import.meta.env.PUBLIC_APP_ENV === "production"
         ? "oidc.is-auth"
@@ -47,6 +53,7 @@ function createUserAccountService() {
 
     return await signInWithCredential(firebaseAuth, cred)
       .then((user) => {
+        signedInIdToken = credential.idToken;
         console.log("authenticated in profile cloud", user);
       })
       .catch((error) => {