Skip to content

MVP2.md

Latest commit

 

History

History
183 lines (136 loc) · 6.44 KB

MVP2.md

File metadata and controls

183 lines (136 loc) · 6.44 KB
Raw

MVP2

Folder: 00-Planning/. Builds on MVP1 (auth base, shell, H2/local, sessions).

GitHub: Project board · Milestone MVP2

Implementation notes: MVP2-IMPLEMENTATION.md

How to read this file (top → bottom):

  1. Scope — what MVP2 phase A includes / excludes
  2. Phase A detail — registration + Google SSO
  3. Work order — steps in sequence
  4. Checklist — mark done as we go
  5. Topic docs
  6. Next — MVP3.md (backlog moved)

1. Scope

In (phase A — start here)

  • User registration — public self-signup; details in 03-security.md
  • Google SSO (OIDC) — ID token from Google Identity Services → API verifies → same Platform session as password login
  • Schema: google_sub (unique, nullable), password_hash nullable for Google-only users
  • Web: /register + “Continue with Google” on /login
  • Keep existing session rules: opaque token, token_hash, one active session per user, 24h / logout

Out of phase A (see MVP3.md)

  • Email verification, invite-only, admin-created users
  • Forgot / reset password; HttpOnly cookies / refresh tokens
  • SAML or non-Google IdPs
  • Roles admin GUI, theme switcher, i18n, landing kit, R2, etc.
  • Payments / memberships (MVP3)

2. Phase A — Registration + Google SSO

2.1 Registration

Already specified in 03-security.md (User registration). Summary:

Item Decision
Endpoint POST /api/auth/register (public)
Body personalId, email, password, confirmPassword
Role Default USER only
After success Auto-login → same LoginResponse shape as login
Web /register; link from /login (“Create account”)
Not yet Email verify, invite-only, CAPTCHA 
sequenceDiagram
  participant User
  participant Web as web
  participant API as api
  participant DB as DB

  User->>Web: Submit register form
  Web->>API: POST /api/auth/register
  API->>DB: Reject if personal_id or email exists
  API->>DB: Insert user BCrypt hash
  API->>DB: Assign role USER
  API->>DB: Create session 24h
  API-->>Web: accessToken plus user
  Web-->>User: Redirect /home
Loading

2.2 Google SSO

Item Decision
Provider Google only (OIDC / ID token)
Front Google Identity Services → credential (ID token)
API POST /api/auth/oauth/google { "idToken": "..." }
Verify aud = client id, iss Google, email verified, not expired
User Find by google_sub; else by verified email (link); else create with role USER, no password
Session Same as password login (revoke others → new session → opaque token)
Env GOOGLE_CLIENT_ID (API + VITE_GOOGLE_CLIENT_ID on web) 
sequenceDiagram
  participant User
  participant Web as web
  participant Google
  participant API as api
  participant DB as DB

  User->>Web: Continue with Google
  Web->>Google: GIS / OIDC
  Google-->>Web: id_token
  Web->>API: POST /api/auth/oauth/google
  API->>Google: Verify id_token JWKS
  API->>DB: Upsert user by google_sub or email
  API->>DB: Revoke other sessions create session
  API-->>Web: accessToken plus user
  Web-->>User: Redirect /home
Loading

2.3 Identity / linking rules

  • Prefer stable key google_sub over email alone.
  • If email already has a password account → link google_sub on that row (same user, can use either login).
  • Google-only users: password_hash null; password login rejected with clear message (or “set password later” — backlog).
  • Never auto-grant ADMIN on register or Google signup.

2.4 Google Cloud (when implementing)

Step-by-step Console guide (project, consent screen, Web client ID, cost notes, local env):

→ 01-Project Instructions/GOOGLE-SSO-SETUP.md

  • OAuth client type Web application.
  • Authorized JavaScript origins: http://localhost:5173 (+ prod URL later).
  • Never commit Client ID/secret to git.

3. Work order (phase A)

Step What Status
1 Flyway: google_sub unique nullable; password_hash nullable; entity/repo updates done
2 POST /api/auth/register + permitAll + validation + USER role + auto session done
3 Web: /register form + link from /login + toasts done
4 Config: GOOGLE_CLIENT_ID / VITE_GOOGLE_CLIENT_ID (local docs) done
5 POST /api/auth/oauth/google + ID token verifier + upsert/link user + session done
6 Web: Continue with Google on /login (and optionally /register) done
7 HOW-TO-RUN + OpenAPI notes for register + Google done

4. Checklist (phase A)

Step 1 — Schema

  • Migration: users.google_sub (unique, nullable)
  • Migration: users.password_hash nullable
  • JPA User + repository lookups by google_sub / email

Step 2 — Register API

  • POST /api/auth/register
  • Validation (email, password policy, confirm match)
  • Unique personalId/email handling
  • BCrypt + role USER + auto-login session
  • Security: permit register path

Step 3 — Register UI

  • Route /register
  • Form + link from /login
  • Success → token → /home; errors via toast

Steps 4–6 — Google SSO

  • Env / config for Google client id
  • POST /api/auth/oauth/google
  • Verify Google ID token server-side
  • Create / link user + session
  • GIS button on login (dark UI)
  • Security: permit oauth path

Step 7 — Docs

  • HOW-TO-RUN.md — register + Google setup
  • Swagger shows new endpoints on local

5. Topic docs

01-general.md · 02-springboot.md · 03-security.md · 04-frontend.md · 05-landing-pages.md · 06-api-optimization.md · MVP1.md

Auth detail for register + Google SSO: 03-security.md.

6. Next

Phase A of MVP2 is done (register + Google SSO).

All former §6 backlog items and new billing/memberships work live in MVP3.md (and 07-payments-memberships.md).

GitHub: former issue #15 retargeted / superseded by MVP3 milestone issues.