fix(oauth): cross-origin session cookies + redirect_uri + authlib import fix

[asifdotpy]

Summary

Five commits on main since PR #4 that were pushed directly without a PR — this surfaces them as a proper reviewable unit.

• fix: add OAUTH_REDIRECT_URI to OAuth client registration — registers an explicit redirect_uri on the authlib Google client (env var OAUTH_REDIRECT_URI); Google now requires pre-registered redirect URIs for the OAuth flow to complete.
• fix: use google.auth.transport.requests.Request — replaces the deprecated google.auth.transport.urllib3.Request with the current google.auth.transport.requests.Request in the OAuth callback token verification.
• fix: place middleware after app creation — moves SessionMiddleware to after app = FastAPI(...) (was before, which is a no-op) and passes an explicit redirect_uri to the OAuth client so Cloud Run (which terminates TLS and forwards as http) can construct the correct https:// callback URL.
• debug: add logging to OAuth callback — adds logger.info/logger.error in the callback handler for query params, session cookie presence, request headers, and the "no ID token" error path.
• fix: allow cross-origin session cookies (samesite=none, secure=true) — sets same_site="none" + https_only=True on SessionMiddleware so the session cookie survives cross-origin requests between the Vercel frontend (*.vercel.app) and the Cloud Run backend (*.run.app). Without this the OAuth flow breaks on the deployed split.

Test plan

• src/web/auth.py imports cleanly: python -c "from src.web import auth"
• src/web/app.py imports cleanly: python -c "from src.web import app"
• OAuth callback uses google.auth.transport.requests.Request (not urllib3)
• SessionMiddleware is added after app = FastAPI(...) (check src/web/app.py line order)
• SessionMiddleware has same_site="none", https_only=True
• GOOGLE_OAUTH_CLIENT registration includes redirect_uri=os.getenv("OAUTH_REDIRECT_URI", "")

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.