Add secure Google sign-in to Progmasoft Account. Use the server-side authorization-code flow with an exact account-domain callback, temporary hardened external cookies, verified provider email matching, canonical Account-name creation for new users, and no separate ViGet publisher identity. Add frontend entry points, provider failure guidance, locked Google authentication dependencies, service secret injection, and backend regression coverage without committing OAuth credentials.1.0.0

3 files changed, 44 insertions, 2 deletions

diff --git a/apps/api-tests/AccountApiFactory.cs b/apps/api-tests/AccountApiFactory.cs
index b1cbca2..3e9d399 100644
--- a/apps/api-tests/AccountApiFactory.cs
+++ b/apps/api-tests/AccountApiFactory.cs
@@ -17,7 +17,9 @@ internal sealed class AccountApiFactory : WebApplicationFactory<Program>
             configuration.AddInMemoryCollection(new Dictionary<string, string?>
             {
                 ["AccountSessions:LifetimeHours"] = "2",
-                ["AccountSessions:CookieName"] = "__Host-ProgmasoftSession"
+                ["AccountSessions:CookieName"] = "__Host-ProgmasoftSession",
+                ["Authentication:Google:ClientId"] = "test-client.apps.googleusercontent.com",
+                ["Authentication:Google:ClientSecret"] = "test-secret"
             });
         });
     }
diff --git a/apps/api-tests/AccountEndpointTests.cs b/apps/api-tests/AccountEndpointTests.cs
index a794e96..c59f6b8 100644
--- a/apps/api-tests/AccountEndpointTests.cs
+++ b/apps/api-tests/AccountEndpointTests.cs
@@ -10,6 +10,38 @@ namespace Progmasoft.Progmaweb.Api.Tests;
 public sealed class AccountEndpointTests
 {
     [Fact]
+    public async Task GoogleStartUsesTheConfiguredCallbackAndPreservesAccountNameInState()
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateAccountClient(handleCookies: false);
+
+        HttpResponseMessage response = await client.GetAsync(
+            "/api/v1/accounts/oauth/google/start?accountName=GoogleUser",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+        Uri location = Assert.IsType<Uri>(response.Headers.Location);
+        Assert.Equal("accounts.google.com", location.Host);
+        Assert.Contains("redirect_uri=https%3A%2F%2Flocalhost%2Fapi%2Fv1%2Faccounts%2Foauth%2Fgoogle%2Fcallback",
+            location.Query, StringComparison.Ordinal);
+        Assert.Contains("state=", location.Query, StringComparison.Ordinal);
+    }
+
+    [Fact]
+    public async Task GoogleStartRejectsInvalidAccountNameBeforeLeavingTheSite()
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateAccountClient(handleCookies: false);
+
+        HttpResponseMessage response = await client.GetAsync(
+            "/api/v1/accounts/oauth/google/start?accountName=lowercase",
+            TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+        Assert.Equal("/register?google=invalid-account-name", response.Headers.Location?.OriginalString);
+    }
+
+    [Fact]
     public async Task RegisterCreatesSessionAndMeReturnsAccount()
     {
         await using AccountApiFactory factory = new();
diff --git a/apps/api-tests/packages.lock.json b/apps/api-tests/packages.lock.json
index 0a5ef16..c4ac317 100644
--- a/apps/api-tests/packages.lock.json
+++ b/apps/api-tests/packages.lock.json
@@ -43,6 +43,11 @@
         "resolved": "2.23.0",
         "contentHash": "nWArUZTdU7iqZLycLKWe0TDms48KKGE6pONH2terYNa8REXiqixrMOkf1sk5DHGMaUTqONU2YkS4SAXBhLStgw=="
       },
+      "Microsoft.AspNetCore.Authentication.Google": {
+        "type": "Transitive",
+        "resolved": "10.0.11",
+        "contentHash": "v/OZld8HxGa5hudLWiChuCf5asMrE36n19sR1RK5cC65SGJoYvQAcwnz3yoAOLDSw90PYc3hgFCh1FW83sakUg=="
+      },
       "Microsoft.AspNetCore.TestHost": {
         "type": "Transitive",
         "resolved": "10.0.11",
@@ -469,7 +474,10 @@
         }
       },
       "progmaweb.api": {
-        "type": "Project"
+        "type": "Project",
+        "dependencies": {
+          "Microsoft.AspNetCore.Authentication.Google": "[10.0.11, )"
+        }
       }
     }
   }