Method HandleCallback

internal/auth/auth.go:343–431

HandleCallback processes the Google OAuth callback and creates a session.

(w http.ResponseWriter, r *http.Request)

// HandleCallback processes the Google OAuth callback and creates a session.
func (ua *UserAuth) HandleCallback(w http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	code := r.URL.Query().Get("code")
	stateParam := r.URL.Query().Get("state")

	if code == "" || stateParam == "" {
		http.Error(w, "missing code or state", http.StatusBadRequest)
		return
	}

	// Decode the OAuth state parameter
	state, err := decodeOAuthState(stateParam)
	if err != nil {
		http.Error(w, "invalid oauth state", http.StatusBadRequest)
		return
	}

	// Verify the nonce matches the cookie
	cookie, err := r.Cookie(StateCookieName)
	if err != nil || cookie.Value != state.Nonce {
		http.Error(w, "invalid oauth state", http.StatusBadRequest)
		return
	}

	// Clear the state cookie
	ua.setCookie(w, StateCookieName, "", -1)

	token, err := ua.oauthConfig.Exchange(ctx, code)
	if err != nil {
		http.Error(w, fmt.Sprintf("oauth exchange failed: %v", err), http.StatusInternalServerError)
		return
	}

	userInfo, err := fetchGoogleUserInfo(ctx, ua.oauthConfig, token, ua.userInfoURL)
	if err != nil {
		http.Error(w, fmt.Sprintf("failed to fetch user info: %v", err), http.StatusInternalServerError)
		return
	}

	if !userInfo.EmailVerified {
		http.Error(w, "email not verified with Google", http.StatusForbidden)
		return
	}

	user, err := ua.store.CreateOrGetUser(ctx, userInfo.Email, userInfo.Name, userInfo.Sub)
	if err != nil {
		http.Error(w, "failed to create user", http.StatusInternalServerError)
		return
	}

	sessionToken, err := ua.store.CreateUserSession(ctx, user.ID)
	if err != nil {
		http.Error(w, "failed to create session", http.StatusInternalServerError)
		return
	}

	ua.setCookie(w, SessionCookieName, sessionToken, int(SessionMaxAge.Seconds()))