feat(auth): enable Google OAuth + expand redirect allowlist

[EmiyaKiritsugu3]

What

Enables Google as an auth provider in the Supabase project and expands the OAuth redirect allowlist so Google login works end-to-end on the deployed app.

Root cause

Google login button returned {"code":400,"error_code":"validation_failed","msg":"Unsupported provider: provider is not enabled"}. Supabase cloud project zqrlsupezgltofwotven had the Google provider disabled — Supabase rejected the request before any redirect. Separately, the additional_redirect_urls glob smartmanagementsystem-*-emiyakiritsugu3s-projects.vercel.app missed the bare production domain smartmanagementsystem-emiyakiritsugu3s-projects.vercel.app (no hyphen segment).

Changes

 [auth.external.google]
 enabled = true
 client_id = "687532012962-b0q21ukr717vvnhnn45ecif23nehvq0q.apps.googleusercontent.com"
 secret = "env(SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET)"
 skip_nonce_check = false

 additional_redirect_urls = [
   "http://localhost:3000/auth/callback",
+  "https://smartmanagementsystem-emiyakiritsugu3s-projects.vercel.app/auth/callback",
+  "https://smartmanagementsystem-git-main-emiyakiritsugu3s-projects.vercel.app/auth/callback",
   "https://smartmanagementsystem-*-emiyakiritsugu3s-projects.vercel.app/auth/callback",
   "https://smartmanagementsystem.vercel.app/auth/callback"
 ]

Secret via env() substitution — never committed, resolves at supabase config push time.

Out-of-band steps (already applied)

• Google Cloud Console: Web OAuth client Five Star Supabase created in project static-subject-497011-j8
  • Authorized redirect URI: https://zqrlsupezgltofwotven.supabase.co/auth/v1/callback
  • Authorized JS origins: https://smartmanagementsystem-emiyakiritsugu3s-projects.vercel.app
• Supabase cloud: supabase config push --project-ref zqrlsupezgltofwotven deployed this config (auth service updated, secret stored hashed)
• Vercel env (Production): NEXT_PUBLIC_APP_URL=https://smartmanagementsystem-emiyakiritsugu3s-projects.vercel.app (was "" empty override → callbackUrl() fell to localhost; runtime server-action read, no rebuild needed)

Pending (out-of-band, user action)

• Google consent screen: currently in Testing mode → only listed test users can OAuth. Publish app (Auth → Audience → PUBLISH APP) to allow any Google account. Scopes (openid/email/profile) are non-sensitive → production active instantly, no Google verification required.

Verify

After publishing consent: https://smartmanagementsystem-emiyakiritsugu3s-projects.vercel.app/login → "Entrar com Google→ Google consent → Supabase callback →/auth/callback?next=%2Fdashboard→ session cookie →/dashboard`.

Refs

• Supabase Google guide: https://github.com/supabase/supabase/blob/master/apps/docs/content/guides/auth/social-login/auth-google.mdx
• Auth redirect fix design: docs/superpowers/specs/2026-07-08-auth-redirect-fix-design.md

---

Summary by cubic

Enable Google OAuth in Supabase and expand the redirect allowlist to include the production Vercel domain. Fixes the "Unsupported provider: provider is not enabled" error and enables Google login in production.

• New Features

  • Enabled [auth.external.google] with client_id and env(SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET).
  • Added the exact prod callback URL to additional_redirect_urls (glob missed the bare prod domain).

• Refactors

  • Removed the explicit git-main redirect URL; it’s covered by the smartmanagementsystem-*-emiyakiritsugu3s-projects.vercel.app glob.

^{Written for commit 9b006c2. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
smartmanagementsystem	Ready	Preview, Comment	Jul 8, 2026 1:02pm

[coderabbitai]

Warning

Review limit reached

@EmiyaKiritsugu3, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c947592f-c15f-422b-9bf7-594b6b07f757

📥 Commits

Reviewing files that changed from the base of the PR and between 794f763 and 9b006c2.

📒 Files selected for processing (1)

• supabase/config.toml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/enable-google-oauth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud