feat(auth): support multiple Google hosted domains

[nicholasjjlim]

Summary

Two related changes to Google sign-in:

1. Multi-domain allowlist. GOOGLE_HOSTED_DOMAIN now accepts a comma-separated list of allowed Google Workspace domains (e.g. moe.edu.sg,hci.edu.sg). A single value behaves exactly as before.
2. Domain-specific rejection message. When a sign-in is rejected because the account's domain isn't allowed, the learner login page now shows an inline message instead of silently bouncing back.

Related: #603

Changes

Multi-domain allowlist

• getAllowedHostedDomains() — parses GOOGLE_HOSTED_DOMAIN by splitting on commas, trimming whitespace, and dropping empties. Returns [] when unset (no restriction).
• verifyIdToken (the security gate) — rejects unless the token's signed hd claim is one of the configured domains; a missing hd claim is still rejected when any domain is configured. Personal @gmail.com accounts (no hd claim) and other Workspace domains are rejected.
• generateAuthURL (UI hint only) — passes the single domain when one is configured, and falls back to * for multiple, since Google's hd parameter accepts only one value. Per Google's docs, hd is an account-chooser hint and not a security control — enforcement lives entirely in verifyIdToken.

Domain-specific rejection message

• HostedDomainMismatchError — a subclass of InvalidIdTokenError thrown specifically for the hosted-domain mismatch (and missing-hd) case. Existing catch-all handling still treats it as a verification failure; callers that care can distinguish it.
• Learner Google callback — maps HostedDomainMismatchError to /login?error=domain_not_allowed (logged at warn, since an outside-domain sign-in is expected behavior, not a fault). All other verification failures still funnel to the generic oauth2_callback_failed.
• Login page — reads the error param and renders an inline message: "You can only sign in with an approved organisation account. Please try again with your work email."

Testing

google.test.ts (10 tests): single / multiple / no configured domains for both functions, comma whitespace tolerance, missing-hd rejection, and that the rejection throws HostedDomainMismatchError (and is still an InvalidIdTokenError).

• pnpm test run src/lib/server/auth/google.test.ts — 10 passed
• pnpm check — 0 errors, 0 warnings
• Manually verified end-to-end: a non-allowlisted account is rejected and the login page shows the message.

Notes / out of scope

• The admin Google callback uses the same verifyIdToken but still funnels all failures to its generic error; it could mirror the domain-specific message later if desired.
• The callback branch and login-page banner aren't unit-tested (no existing harness for that route); covered by the unit test on the error type plus manual verification.

[nicholasjjlim]

Code Review Summary

Severity	Count
Critical	0
High	0
Medium	0
Low	1

One Low finding posted inline on src/lib/server/auth/google.ts: domain matching normalises whitespace but not case, so a mis-cased config entry would silently lock out all users of that domain.

What Looks Good

• HostedDomainMismatchError subclassing InvalidIdTokenError is the right call — existing catch-all handlers keep rejecting it, while the callback can branch on it for a tailored message; and the callback correctly checks the subclass before the generic case.
• The hd account-chooser hint logic (undefined for none, the domain for one, * for many) is sound, and the inline comment correctly notes the real enforcement still lives in verifyIdToken — the hint is never trusted as the gate.
• Strong test coverage: single vs. multi-domain accept/reject, whitespace tolerance, missing-hd rejection, and the unconfigured pass-through case are all exercised, including asserting the error is both a HostedDomainMismatchError and an InvalidIdTokenError.
• The login page maps known error codes to tailored copy and falls back to a generic message for any other non-empty code, with an accessible role="alert" container.

---

🤖 aif-code-review · claude-opus-4-8[1m]

[nicholasjjlim]

LGTM 👍

---

🤖 aif-code-review · claude-opus-4-8[1m]