From 232628670e0da47370bd3bdd44212a1b9e79aa68 Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Thu, 21 May 2026 12:37:06 +0530 Subject: [PATCH 1/7] feat: Google OAuth prompt parameter and login OAuth error display - Add dedicated googleOAuth.svelte modal with prompt picker in Advanced section - Add googlePromptPicker.svelte: tag-based multi-select enforcing none exclusivity - Wire prompt array through updateOAuth.ts to updateOAuth2Google SDK call - Fix OIDC advanced param detection to URL-based logic (all URL params except wellKnownURL) - Show OAuth failure URL error message on login page via onMount --- src/lib/stores/oauth-providers.ts | 5 +- .../auth/(providers)/googleOAuth.svelte | 194 ++++++++++++++++++ .../(providers)/googlePromptPicker.svelte | 42 ++++ .../auth/(providers)/mainOAuth.svelte | 2 +- .../auth/updateOAuth.ts | 21 +- .../(public)/(guest)/login/+page.svelte | 8 + 6 files changed, 265 insertions(+), 7 deletions(-) create mode 100644 src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte create mode 100644 src/routes/(console)/project-[region]-[project]/auth/(providers)/googlePromptPicker.svelte diff --git a/src/lib/stores/oauth-providers.ts b/src/lib/stores/oauth-providers.ts index 1a2143a178..f1b8d699dc 100644 --- a/src/lib/stores/oauth-providers.ts +++ b/src/lib/stores/oauth-providers.ts @@ -1,5 +1,6 @@ import type { Component } from 'svelte'; import Main from '$routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte'; +import Google from '$routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte'; export type Provider = { name: string; @@ -129,13 +130,13 @@ export const oAuthProviders: Record = { name: 'Google', icon: 'google', docs: 'https://support.google.com/googleapi/answer/6158849', - component: Main + component: Google }, googleImagine: { name: 'Google', icon: 'google', docs: 'https://support.google.com/googleapi/answer/6158849', - component: Main, + component: Google, internal: true }, keycloak: { diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte new file mode 100644 index 0000000000..aa6ac6e5f2 --- /dev/null +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte @@ -0,0 +1,194 @@ + + + +

+ To use Google authentication in your application, first fill in this form. For more info you + can + visit the docs. +

+ + + + {#if appIdParam} + + {/if} + + {#if !showSecretInput} +
+ (showSecretInput = true)}> + Update Client Secret + +
+ {:else} + + + + + Client Secret + + + + This field is write-only. Enter a new value to update it. + + + + + + + + + + + {/if} + + + + + + + To complete set up, add this OAuth2 redirect URI to your Google app configuration. + + + + + + + +
diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googlePromptPicker.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googlePromptPicker.svelte new file mode 100644 index 0000000000..0f5a21a23c --- /dev/null +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googlePromptPicker.svelte @@ -0,0 +1,42 @@ + + + + Prompt + + {#each options as option (option.val)} + toggle(option.val)}> + {option.label} + + {/each} + + diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte index 574cc3d29f..f7d0788c24 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte @@ -148,7 +148,7 @@ } function isOidcAdvancedParam(id: string): boolean { - return id === 'authorizationURL' || id === 'tokenUrl' || id === 'userInfoUrl'; + return id !== 'wellKnownURL' && id.toLowerCase().includes('url'); } async function handleP8FileUpload(id: string, event: Event) { diff --git a/src/routes/(console)/project-[region]-[project]/auth/updateOAuth.ts b/src/routes/(console)/project-[region]-[project]/auth/updateOAuth.ts index 59d50a55bc..e4205a7f57 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/updateOAuth.ts +++ b/src/routes/(console)/project-[region]-[project]/auth/updateOAuth.ts @@ -4,7 +4,7 @@ import { Dependencies } from '$lib/constants'; import { isValueOfStringEnum } from '$lib/helpers/types'; import { addNotification } from '$lib/stores/notifications'; import { sdk } from '$lib/stores/sdk'; -import { OAuthProvider, type Models as ConsoleModels } from '@appwrite.io/console'; +import { OAuthProvider, ProjectOAuth2GooglePrompt, type Models as ConsoleModels } from '@appwrite.io/console'; type ProjectOAuthProvider = ConsoleModels.OAuth2ProviderList['providers'][number]; @@ -21,6 +21,7 @@ type Args = { secret: string | null; details: Record; enabled: boolean; + promptValues?: ProjectOAuth2GooglePrompt[]; }; type Return = { @@ -45,7 +46,8 @@ async function updateProjectOAuth({ appId, secret, details, - enabled + enabled, + promptValues }: Args) { const projectSdk = sdk.forProject(region, projectId).project; const parsedSecret = parseSecret(secret); @@ -184,6 +186,7 @@ async function updateProjectOAuth({ return projectSdk.updateOAuth2Google({ clientId: getAppId(), clientSecret: getSecret(), + prompt: promptValues ?? [], enabled }); case OAuthProvider.Keycloak: @@ -345,14 +348,24 @@ export async function updateOAuth({ appId, secret, details, - enabled + enabled, + promptValues }: Args): Promise { try { if (!isValueOfStringEnum(OAuthProvider, provider.key)) { throw new Error(`Invalid OAuth2 provider: ${provider.key}`); } - await updateProjectOAuth({ region, projectId, provider, appId, secret, details, enabled }); + await updateProjectOAuth({ + region, + projectId, + provider, + appId, + secret, + details, + enabled, + promptValues + }); await invalidate(Dependencies.PROJECT); addNotification({ diff --git a/src/routes/(public)/(guest)/login/+page.svelte b/src/routes/(public)/(guest)/login/+page.svelte index 529fcf685e..4852ea31d7 100644 --- a/src/routes/(public)/(guest)/login/+page.svelte +++ b/src/routes/(public)/(guest)/login/+page.svelte @@ -1,6 +1,7 @@ From a247ab7e928c636dd0f9bb3ac1f2c55b8778787a Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Thu, 21 May 2026 12:42:05 +0530 Subject: [PATCH 3/7] =?UTF-8?q?fix:=20address=20PR=20review=20=E2=80=94=20?= =?UTF-8?q?sanitize=20OAuth=20error=20message=20and=20revert=20OIDC=20para?= =?UTF-8?q?m=20heuristic?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../auth/(providers)/mainOAuth.svelte | 2 +- src/routes/(public)/(guest)/login/+page.svelte | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte index f7d0788c24..574cc3d29f 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte @@ -148,7 +148,7 @@ } function isOidcAdvancedParam(id: string): boolean { - return id !== 'wellKnownURL' && id.toLowerCase().includes('url'); + return id === 'authorizationURL' || id === 'tokenUrl' || id === 'userInfoUrl'; } async function handleP8FileUpload(id: string, event: Event) { diff --git a/src/routes/(public)/(guest)/login/+page.svelte b/src/routes/(public)/(guest)/login/+page.svelte index 4852ea31d7..e6bb319efc 100644 --- a/src/routes/(public)/(guest)/login/+page.svelte +++ b/src/routes/(public)/(guest)/login/+page.svelte @@ -20,9 +20,8 @@ export let data; onMount(() => { - const oauthError = page.url.searchParams.get('message'); - if (oauthError) { - addNotification({ type: 'error', message: oauthError }); + if (page.url.searchParams.has('message')) { + addNotification({ type: 'error', message: 'OAuth authentication failed. Please try again.' }); } }); From ac30ff1f6cd3e8eca01e3a4e948c1beb6369ca5c Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Thu, 21 May 2026 12:43:32 +0530 Subject: [PATCH 4/7] fix: revert OIDC advanced param to URL-based heuristic per design intent --- .../auth/(providers)/mainOAuth.svelte | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte index 574cc3d29f..f7d0788c24 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte @@ -148,7 +148,7 @@ } function isOidcAdvancedParam(id: string): boolean { - return id === 'authorizationURL' || id === 'tokenUrl' || id === 'userInfoUrl'; + return id !== 'wellKnownURL' && id.toLowerCase().includes('url'); } async function handleP8FileUpload(id: string, event: Event) { From dbbd29be3e79107166bb3abcf22422c6d17c188e Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Thu, 21 May 2026 12:46:34 +0530 Subject: [PATCH 5/7] fix: move client secret below Advanced accordion to match mainOAuth pattern --- .../auth/(providers)/googleOAuth.svelte | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte index aa6ac6e5f2..f2d0d705e0 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte @@ -134,6 +134,10 @@ bind:value={appId} /> {/if} + + + + {#if !showSecretInput}
(showSecretInput = true)}> @@ -176,10 +180,6 @@ {/if} - - - - To complete set up, add this OAuth2 redirect URI to your Google app configuration. From 1d8876bfd99da01fe22e7d866d1ccb61abd202f8 Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Thu, 21 May 2026 12:49:01 +0530 Subject: [PATCH 6/7] fix: move credentials above Advanced accordion in OAuth modals --- .../auth/(providers)/googleOAuth.svelte | 8 ++--- .../auth/(providers)/mainOAuth.svelte | 30 +++++++++---------- 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte index f2d0d705e0..aa6ac6e5f2 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte @@ -134,10 +134,6 @@ bind:value={appId} /> {/if} - - - - {#if !showSecretInput}
(showSecretInput = true)}> @@ -180,6 +176,10 @@ {/if} + + + + To complete set up, add this OAuth2 redirect URI to your Google app configuration. diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte index f7d0788c24..7dd6181888 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/mainOAuth.svelte @@ -245,21 +245,6 @@ bind:value={fieldValues[param.$id]} /> {/each} - {#if advancedDetailParams.length > 0} - - - {#each advancedDetailParams as param} - - {/each} - - - {/if} - {#if secretParams.length > 0} {#if !showSecretInput}
@@ -372,6 +357,21 @@ {/if} {/if} + {#if advancedDetailParams.length > 0} + + + {#each advancedDetailParams as param} + + {/each} + + + {/if} + To complete set up, add this OAuth2 redirect URI to your {provider.name} app configuration. From 3862b0cde7f9e6ed2dbe230763f1ab6bc54fc50a Mon Sep 17 00:00:00 2001 From: harsh mahajan Date: Thu, 21 May 2026 12:49:39 +0530 Subject: [PATCH 7/7] format --- .../auth/(providers)/googleOAuth.svelte | 13 ++++++------- .../auth/(providers)/googlePromptPicker.svelte | 5 +---- .../project-[region]-[project]/auth/updateOAuth.ts | 6 +++++- src/routes/(public)/(guest)/login/+page.svelte | 5 ++++- 4 files changed, 16 insertions(+), 13 deletions(-) diff --git a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte index aa6ac6e5f2..12bcf06c55 100644 --- a/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte +++ b/src/routes/(console)/project-[region]-[project]/auth/(providers)/googleOAuth.svelte @@ -1,14 +1,13 @@