feat: login with google

Author: makara4code

.claude/settings.local.json

@@ -6,7 +6,19 @@
       "Bash(uv run alembic:*)",
       "Bash(uv run python:*)",
       "Bash(git rm:*)",
-      "Bash(git add:*)"
+      "Bash(git add:*)",
+      "Bash(npm run generate-client:*)",
+      "Bash(cat:*)",
+      "Bash(npm uninstall:*)",
+      "Bash(npm run dev:*)",
+      "Bash(netstat:*)",
+      "Bash(findstr:*)",
+      "Bash(dir /s /b \"c:\\Users\\makara\\Desktop\\full-stack-fastapi-template\\frontend\\src\\routes\")",
+      "Bash(taskkill:*)",
+      "Bash(powershell -Command \"Stop-Process -Id 8644 -Force\")",
+      "Bash(powershell -Command:*)",
+      "Bash(uv sync:*)",
+      "Bash(python:*)"
     ],
     "deny": [],
     "ask": []

backend/app/api/routes/login.py

@@ -1,9 +1,10 @@
 from datetime import timedelta
 from typing import Annotated, Any
+from urllib.parse import urlencode
 
 import httpx
 from fastapi import APIRouter, Depends, HTTPException
-from fastapi.responses import HTMLResponse
+from fastapi.responses import HTMLResponse, RedirectResponse
 from fastapi.security import OAuth2PasswordRequestForm
 from pydantic import BaseModel
 
@@ -214,3 +215,130 @@ def login_google(session: SessionDep, body: GoogleLoginRequest) -> Token:
         raise
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"Error processing Google login: {str(e)}")
+
+
+@router.get("/login/google/authorize")
+def google_authorize() -> RedirectResponse:
+    """
+    Initiate Google OAuth flow by redirecting to Google's authorization page
+    """
+    if not settings.GOOGLE_CLIENT_ID:
+        raise HTTPException(
+            status_code=500,
+            detail="Google OAuth is not configured. Please set GOOGLE_CLIENT_ID in environment variables."
+        )
+
+    # Build the authorization URL
+    params = {
+        "client_id": settings.GOOGLE_CLIENT_ID,
+        "redirect_uri": f"{settings.FRONTEND_HOST}/login/callback",
+        "response_type": "code",
+        "scope": "openid email profile",
+        "access_type": "online",
+        "prompt": "select_account",
+    }
+
+    auth_url = f"https://accounts.google.com/o/oauth2/v2/auth?{urlencode(params)}"
+    return RedirectResponse(url=auth_url)
+
+
+class GoogleCallbackRequest(BaseModel):
+    code: str
+
+
+@router.post("/login/google/callback")
+def google_callback(session: SessionDep, body: GoogleCallbackRequest) -> Token:
+    """
+    Handle Google OAuth callback and exchange authorization code for tokens
+    """
+    if not settings.GOOGLE_CLIENT_ID or not settings.GOOGLE_CLIENT_SECRET:
+        raise HTTPException(
+            status_code=500,
+            detail="Google OAuth is not configured. Please set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in environment variables."
+        )
+
+    try:
+        # Exchange authorization code for tokens
+        token_response = httpx.post(
+            "https://oauth2.googleapis.com/token",
+            data={
+                "code": body.code,
+                "client_id": settings.GOOGLE_CLIENT_ID,
+                "client_secret": settings.GOOGLE_CLIENT_SECRET,
+                "redirect_uri": f"{settings.FRONTEND_HOST}/login/callback",
+                "grant_type": "authorization_code",
+            },
+        )
+
+        if token_response.status_code != 200:
+            error_detail = token_response.json().get("error_description", "Failed to exchange authorization code")
+            raise HTTPException(status_code=400, detail=f"Google OAuth error: {error_detail}")
+
+        tokens = token_response.json()
+        id_token = tokens.get("id_token")
+
+        if not id_token:
+            raise HTTPException(status_code=400, detail="No ID token received from Google")
+
+        # Verify the ID token
+        verify_response = httpx.get(
+            f"https://oauth2.googleapis.com/tokeninfo?id_token={id_token}"
+        )
+
+        if verify_response.status_code != 200:
+            raise HTTPException(status_code=400, detail="Invalid Google token")
+
+        token_info = verify_response.json()
+
+        # Verify the audience (must match our Google Client ID)
+        if token_info.get("aud") != settings.GOOGLE_CLIENT_ID:
+            raise HTTPException(status_code=400, detail="Invalid token audience")
+
+        # Verify the issuer
+        if token_info.get("iss") not in ["https://accounts.google.com", "accounts.google.com"]:
+            raise HTTPException(status_code=400, detail="Invalid token issuer")
+
+        # Extract user information from the token
+        email = token_info.get("email")
+        full_name = token_info.get("name")
+        google_id = token_info.get("sub")
+
+        if not email or not google_id:
+            raise HTTPException(status_code=400, detail="Invalid token: missing required fields")
+
+        # Check if user exists
+        user = crud.get_user_by_email(session=session, email=email)
+
+        if not user:
+            # Create new user with OAuth
+            user_create = UserCreateOAuth(
+                email=email,
+                full_name=full_name,
+                oauth_provider="google",
+                oauth_id=google_id
+            )
+            user = crud.create_user_oauth(session=session, user_create=user_create)
+        else:
+            # Update existing user with OAuth info if not already set
+            if not user.oauth_provider:
+                user.oauth_provider = "google"
+                user.oauth_id = google_id
+                session.add(user)
+                session.commit()
+                session.refresh(user)
+
+        if not user.is_active:
+            raise HTTPException(status_code=400, detail="Inactive user")
+
+        # Create access token
+        access_token_expires = timedelta(minutes=settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+        return Token(
+            access_token=security.create_access_token(
+                user.id, expires_delta=access_token_expires
+            )
+        )
+
+    except HTTPException:
+        raise
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=f"Error processing Google callback: {str(e)}")

backend/pyproject.toml

@@ -18,8 +18,8 @@ dependencies = [
     "authlib<2.0.0,>=1.3.0",
     "psycopg[binary]<4.0.0,>=3.1.13",
     "sqlmodel<1.0.0,>=0.0.21",
-    # Pin bcrypt until passlib supports the latest
-    "bcrypt==4.3.0",
+    # Pin bcrypt to 4.0.x for passlib compatibility
+    "bcrypt>=4.0.0,<4.1.0",
     "pydantic-settings<3.0.0,>=2.2.1",
     "sentry-sdk[fastapi]<2.0.0,>=1.40.6",
     "pyjwt<3.0.0,>=2.8.0",