Sign up and log in with Google #80

Part of Pair 3: feedback that trains the model (Geo + Bhuvan), under #99.

Problem

The manager needs a way to get into the app. We don't want to store passwords, and Google sign-in is what the design shows.

Goal

Anyone can sign in with their Google account. The first sign-in creates their user; later sign-ins find it. They stay signed in until they log out or the session expires.

Scope

• Google OAuth 2.0 / OpenID Connect sign-in using the authorization code flow:
  • GET /auth/google/login redirects to Google.
  • GET /auth/google/callback verifies Google's response, creates or finds the user, starts a session and redirects back to the frontend.
• POST /auth/logout ends the session; GET /auth/me returns the signed-in user and their hotels.
• Sessions in an HTTP-only, secure cookie that expires.
• Find or create the user by Google account id (sub), and on every sign-in update their email, name and last_signed_in_at. Today's user.create_user returns a conflict for a known account, so this needs a new service function (decision 0035).
• A Google Cloud OAuth client with redirect URLs for local development and production; its setup steps written in the README.
• New settings (e.g. GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, SESSION_SECRET, frontend URL) in config.py and .env.example.
• Any new libraries added to pyproject.toml.
• Not in scope: the sign-in screen (frontend), other providers, and email + password.

Considerations

• Use a maintained OAuth/OIDC library rather than hand-rolling token checks; verify the state parameter and Google's ID token.
• The frontend and API may be on different domains in production. The callback lives on the API and sets the cookie there; cookie SameSite settings and CORS must allow credentials from the frontend.
• Anyone with a Google account can sign up, so a new user must see nothing until they're linked to a hotel.
• Keep Google secrets out of the repo and the frontend.

Acceptance criteria

• Signing in with a Google account for the first time creates a user; signing in again doesn't create a second one.
• After signing in, GET /auth/me returns the user; after logging out it returns 401.
• An expired or tampered session cookie returns 401.
• A forged or missing state on the callback is rejected.
• Sign-in works locally and on production.