feat(auth): Firebase Auth Google Sign-In Integration

[Tambeej]

Overview

This PR implements Firebase Authentication with Google provider for user sign-in and registration in the Morty backend.

Completed Tasks

1. POST /api/auth/google endpoint — Added a new endpoint that receives a Firebase ID token from the client and verifies it using admin.auth().verifyIdToken().

2. Updated userService — Extended the user service to create or retrieve a user by Firebase UID/email, and store the firebaseUid field in the Firestore user document.

3. JWT token generation — Upon successful Firebase token verification, the backend generates custom access and refresh JWT tokens for the authenticated user.

4. Refresh token persistence — The refresh token is persisted in Firestore and the auth payload returned is fully compatible with the existing frontend auth flow.

5. Updated authController and routes — The authController and src/routes/auth.js have been updated to wire up the new /api/auth/google endpoint.

API Contract

POST /api/auth/google
Content-Type: application/json

Request body:
{
  "idToken": "<Firebase ID token from Google Sign-In>"
}

Response (200 OK):
{
  "success": true,
  "data": {
    "user": { "id": "...", "email": "...", "name": "...", "firebaseUid": "..." },
    "accessToken": "<JWT access token>",
    "refreshToken": "<JWT refresh token>"
  }
}

Related

• Original request: Use Firebase Auth with Google provider for user sign-in / register
• Frontend will call this endpoint after obtaining a Firebase ID token via signInWithPopup / signInWithRedirect.

[Tambeej]

🤖 Code-Pilot Team Leader (adk)

✅ APPROVED

✅ Backend PR Review — Google Auth via Firebase

All 5 tasks have been implemented correctly and align with the architecture design. The code is well-structured, secure, and thoroughly tested.

Task Verification

#	Task	Status
1	POST /api/auth/google endpoint with admin.auth().verifyIdToken()	✅
2	userService findOrCreateByFirebaseUser() with firebaseUid storage	✅
3	Custom access (15m) and refresh (7d) JWT generation	✅
4	Refresh token persisted in Firestore, frontend-compatible payload	✅
5	authController, routes, and validation updated	✅

Security ✅

• Firebase ID token verified server-side only via Admin SDK
• Rate limiting applied via authLimiter on /google endpoint
• Input validation via Joi schema
• No sensitive fields leaked (password, refreshToken, firebaseUid stripped by toPublicUser)
• Google-only accounts properly rejected for email/password login (GOOGLE_ACCOUNT error code)
• 409 Conflict for email already linked to a different Firebase UID

Architecture Alignment ✅

• Data flow matches architecture spec (steps 5–9)
• Three-path user resolution (returning Google user → email linking → new user) implemented correctly
• No breaking changes to existing email/password auth flow

Test Coverage ✅

• Integration tests: 7 new Google Auth test cases covering validation, auth failures, success, edge cases
• Unit tests: Comprehensive findOrCreateByFirebaseUser tests covering all 3 paths, conflict detection, input validation
• Firebase Admin SDK properly mocked

Minor Note (non-blocking)

• googleSchema is defined in both src/middleware/validate.js and src/validators/authValidators.js. The route uses the one from validate.js. The duplicate in authValidators.js is harmless but could be cleaned up in a future PR.

LGTM — well-implemented, secure, and thoroughly tested. 🚀

---

Reviewed at 2026-04-03 10:56:40 UTC