Skip to content

feat: full refresh review + Google sign-in - #1

Open
rileygramlich wants to merge 2 commits into
mainfrom
feature/review-refresh-google-auth
Open

feat: full refresh review + Google sign-in#1
rileygramlich wants to merge 2 commits into
mainfrom
feature/review-refresh-google-auth

Conversation

@rileygramlich

@rileygramlich rileygramlich commented Apr 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

What this PR does

  • adds Google sign-in support end-to-end (frontend + backend)
  • performs a review-driven refresh of auth/runtime setup
  • documents setup and technical findings

Google Sign-In implementation

  • Frontend:
    • adds @react-oauth/google
    • wraps app in GoogleOAuthProvider when REACT_APP_GOOGLE_CLIENT_ID is present
    • adds Google login button on Auth page
  • Backend:
    • adds POST /api/users/google
    • verifies Google ID token via google-auth-library
    • creates or links user account by email
    • issues existing JWT session token on success

Refresh improvements

  • tighten JWT payload to safe user fields only
  • user model now supports local + google auth (googleId, authProvider)
  • server now starts in production (all envs except test)
  • replace hardcoded CORS with env-driven allowlist (CORS_ORIGIN)
  • add .env.example
  • add review notes in docs/REVIEW_REFRESH.md
  • update README with local + Google auth setup

Validation

  • npm run build ✅

Known remaining backlog

  • legacy dependency vulnerabilities remain (npm audit reports high/critical)
  • existing React hook dependency warnings remain in timer/berserk/doc/typetest components
  • CRA stack deprecation should be addressed in a future migration pass

@vercel

vercel Bot commented Apr 26, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
scribist Ready Ready Preview Sep 6, 2026 11:53am UTC

@rileygramlich @claude
fix(deps): bump nanoid to 3.3.18 to patch infinite-loop advisories
461e332 
Resolves GHSA-2v37-7h3g-55p8 (custom generators can loop indefinitely
when size is zero, high). The bump also clears two older nanoid
advisories still open at 3.3.7: GHSA-28wg-ghj8-5hjv and
GHSA-xwg4-73v4-xw9w.

nanoid is a transitive dependency via postcss, whose range (^3.3.7)
already allows 3.3.18, so this is a lockfile-only change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rileygramlich