feat: google auth with secret manager and testing

terraform/firebase.tf

@@ -70,6 +70,13 @@ resource "google_identity_platform_config" "default" {
   provider = google-beta
   project  = var.project_id
 
+  # Authorized Domains for OAuth
+  authorized_domains = [
+    "localhost",
+    "${var.project_id}.firebaseapp.com",
+    "${var.project_id}.web.app",
+  ]
+
   # Enable Google Sign-In (and others if needed, but keeping it simple)
   sign_in {
     allow_duplicate_emails = false
@@ -86,6 +93,18 @@ resource "google_identity_platform_config" "default" {
   depends_on = [google_project_service.identitytoolkit]
 }
 
+# Enable Google Default Identity Provider
+resource "google_identity_platform_default_supported_idp_config" "google" {
+  provider      = google-beta
+  project       = var.project_id
+  enabled       = true
+  idp_id        = "google.com"
+  client_id     = data.google_secret_manager_secret_version.oauth_client_id.secret_data
+  client_secret = data.google_secret_manager_secret_version.oauth_client_secret.secret_data
+
+  depends_on = [google_project_service.identitytoolkit]
+}
+
 # NOTE: OAuth Client ID usually needs to be configured in console for Identity Platform
 # or imported. Terraform support for *creating* the OAuth client for IAP/Identity is limited/complex.
 # We will assume the default one created by Firebase is used or documented.

terraform/secrets.tf

@@ -0,0 +1,14 @@
+# Fetch secrets from Secret Manager
+# Expects these secrets to be created via scripts/manage_secrets.py
+
+data "google_secret_manager_secret_version" "oauth_client_id" {
+  provider = google-beta
+  project  = var.project_id
+  secret   = "haumdaucher-oauth-client-id"
+}
+
+data "google_secret_manager_secret_version" "oauth_client_secret" {
+  provider = google-beta
+  project  = var.project_id
+  secret   = "haumdaucher-oauth-client-secret"
+}

terraform/variables.tf

@@ -10,6 +10,7 @@ variable "region" {
   default     = "europe-west3"
 }
 
+
 variable "allowed_users" {
   description = "List of email addresses allowed to access restricted features"
   type        = list(string)