Use shared Google client secret names in dev deploy

Author: jjoonleo

.github/workflows/deploy-dev.yml

@@ -126,8 +126,8 @@ jobs:
             JWT_ACCESS_HEADER=${{ secrets.DEV_JWT_ACCESS_HEADER || 'Authorization' }}
             JWT_REFRESH_HEADER=${{ secrets.DEV_JWT_REFRESH_HEADER || 'Authorization-refresh' }}
 
-            GOOGLE_WEB_CLIENT_ID=${{ secrets.DEV_GOOGLE_WEB_CLIENT_ID || 'dev-google-web-client-id' }}
-            GOOGLE_APP_CLIENT_ID=${{ secrets.DEV_GOOGLE_APP_CLIENT_ID || 'dev-google-app-client-id' }}
+            GOOGLE_WEB_CLIENT_ID=${{ secrets.GOOGLE_WEB_CLIENT_ID || 'dev-google-web-client-id' }}
+            GOOGLE_APP_CLIENT_ID=${{ secrets.GOOGLE_APP_CLIENT_ID || 'dev-google-app-client-id' }}
 
             APPLE_CLIENT_ID=${{ secrets.DEV_APPLE_CLIENT_ID || 'dev-apple-client-id' }}
             APPLE_TEAM_ID=${{ secrets.DEV_APPLE_TEAM_ID || 'dev-apple-team-id' }}

docs/deployment.md

@@ -143,8 +143,8 @@ Optional development secrets:
 - `DEV_JWT_REFRESH_EXPIRATION`
 - `DEV_JWT_ACCESS_HEADER`
 - `DEV_JWT_REFRESH_HEADER`
-- `DEV_GOOGLE_WEB_CLIENT_ID`
-- `DEV_GOOGLE_APP_CLIENT_ID`
+- `GOOGLE_WEB_CLIENT_ID`
+- `GOOGLE_APP_CLIENT_ID`
 - `DEV_APPLE_CLIENT_ID`
 - `DEV_APPLE_TEAM_ID`
 - `DEV_APPLE_LOGIN_KEY`
@@ -212,8 +212,8 @@ Optional development secrets:
 - `DEV_JWT_REFRESH_EXPIRATION`
 - `DEV_JWT_ACCESS_HEADER`
 - `DEV_JWT_REFRESH_HEADER`
-- `DEV_GOOGLE_WEB_CLIENT_ID`
-- `DEV_GOOGLE_APP_CLIENT_ID`
+- `GOOGLE_WEB_CLIENT_ID`
+- `GOOGLE_APP_CLIENT_ID`
 - `DEV_APPLE_CLIENT_ID`
 - `DEV_APPLE_TEAM_ID`
 - `DEV_APPLE_LOGIN_KEY`

ontime-back/src/main/java/devkor/ontime_back/global/oauth/google/GoogleLoginService.java

@@ -66,6 +66,9 @@ public GoogleLoginService(
                 .map(String::trim)
                 .filter(clientId -> !clientId.isBlank())
                 .toList();
+        log.info("Configured Google OAuth audiences: {}", validClientIds.stream()
+                .map(this::maskClientId)
+                .toList());
     }
 
 
@@ -173,10 +176,52 @@ public GoogleIdToken.Payload verifyIdentityToken(String identityToken) throws Ex
             return payload;
         } else {
             log.info("Google identity credential is invalid");
+            logGoogleIdentityTokenClaims(identityToken);
             return null;
         }
     }
 
+    private void logGoogleIdentityTokenClaims(String identityToken) {
+        try {
+            GoogleIdToken parsedToken = GoogleIdToken.parse(
+                    GsonFactory.getDefaultInstance(),
+                    identityToken
+            );
+            GoogleIdToken.Payload payload = parsedToken.getPayload();
+            String audience = String.valueOf(payload.getAudience());
+            Long expirationTimeSeconds = payload.getExpirationTimeSeconds();
+            long nowSeconds = System.currentTimeMillis() / 1000;
+            log.info(
+                    "Google identity token claims aud={}, azp={}, iss={}, exp={}, now={}, secondsUntilExp={}, audienceAllowed={}",
+                    maskClientId(audience),
+                    payload.get("azp"),
+                    payload.getIssuer(),
+                    expirationTimeSeconds,
+                    nowSeconds,
+                    expirationTimeSeconds == null ? null : expirationTimeSeconds - nowSeconds,
+                    validClientIds.contains(audience)
+            );
+        } catch (Exception e) {
+            log.info("Google identity token claim parsing failed: {}", e.getClass().getSimpleName());
+        }
+    }
+
+    private String maskClientId(String clientId) {
+        int separatorIndex = clientId.indexOf('-');
+        if (separatorIndex < 0) {
+            return "<invalid-client-id>";
+        }
+        String projectNumber = clientId.substring(0, separatorIndex);
+        String suffix = ".apps.googleusercontent.com";
+        boolean hasGoogleSuffix = clientId.endsWith(suffix);
+        String middle = clientId.substring(
+                separatorIndex + 1,
+                hasGoogleSuffix ? clientId.length() - suffix.length() : clientId.length()
+        );
+        String visibleTail = middle.length() <= 4 ? middle : middle.substring(middle.length() - 4);
+        return projectNumber + "-..." + visibleTail + (hasGoogleSuffix ? suffix : "");
+    }
+
     public boolean revokeToken(Long userId) {
         User user = userRepository.findById(userId)
                 .orElseThrow(() -> new IllegalArgumentException("User not found with id: " + userId));

ontime-back/src/main/resources/application-dev.properties

@@ -23,8 +23,8 @@ jwt.access.header=${JWT_ACCESS_HEADER:Authorization}
 jwt.refresh.header=${JWT_REFRESH_HEADER:Authorization-refresh}
 
 # Google OAuth
-google.web.client-id=${GOOGLE_WEB_CLIENT_ID:dev-google-web-client-id}
-google.app.client-id=${GOOGLE_APP_CLIENT_ID:dev-google-app-client-id}
+google.web.client-id=${GOOGLE_WEB_CLIENT_ID:456571312261-5kuf2r6i5i7lqjr7qealv06sdgkn3hcp.apps.googleusercontent.com}
+google.app.client-id=${GOOGLE_APP_CLIENT_ID:456571312261-r35ah9qi0qaq7al007e2db0e0jmjcmb4.apps.googleusercontent.com,456571312261-5e99nruk62f21uoh7stfp8i82acmh6iq.apps.googleusercontent.com,456571312261-6470v6goejjkcqn3608b4nbbtpt6dknu.apps.googleusercontent.com}
 
 # Apple OAuth
 apple.client.id=${APPLE_CLIENT_ID:dev-apple-client-id}