Skip to content

Use Google sub as temporary password, add 409 fallback handling, and document Google auth flow #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
danielitoCode wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Use Google sub as temporary password, add 409 fallback handling, and document Google auth flow #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 24 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,4 +88,27 @@ app/
```

## Contribución
Si deseas contribuir, crea una rama, realiza tus cambios y abre un pull request.
Si deseas contribuir, crea una rama, realiza tus cambios y abre un pull request.

## Flujo de autenticación con Google (actual)

### Objetivo
- Mantener un acceso de “un toque” para usuarios Google en Appwrite usando credenciales de email/password por detrás.
- Permitir que cualquier usuario cambie su contraseña sin romper su cuenta.

### Reglas del flujo
1. **Default Google**:
- `email` de la cuenta Appwrite = email de Google.
- `password` inicial = `sub` de Google.
- En `prefs` se guarda `sub` (`prefs.sub = sub`) junto al resto de metadatos.
2. **Cambio de contraseña**:
- El usuario puede cambiar su contraseña libremente.
- El `sub` se mantiene en `prefs`; no se elimina.
3. **Google one-tap**:
- Funciona directamente mientras la contraseña actual siga siendo el `sub`.
4. **Fallback (Opción A)**:
- Si el login one-tap falla porque el usuario ya cambió su contraseña, se muestra un mensaje guiando a iniciar una vez con correo+contraseña para continuar usando Google.

### Detalle técnico del fallback
- En error de autenticación Google (`401`) se intenta alta automática.
- Si la alta responde `409` (cuenta ya existe), se interpreta como posible contraseña cambiada y se devuelve el mensaje de recuperación con login tradicional una vez.
39 changes: 18 additions & 21 deletions ...src/main/java/com/elitec/alejotaller/feature/auth/domain/caseuse/AuthWithGoogleCaseUse.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package com.elitec.alejotaller.feature.auth.domain.caseuse

import android.content.Context
import com.elitec.alejotaller.feature.auth.domain.caseuse.util.hashEmailWithSub
import com.elitec.alejotaller.feature.auth.domain.entity.UserProfile
import com.elitec.alejotaller.feature.auth.domain.ports.GoogleAuthProvider
import com.elitec.alejotaller.feature.auth.domain.ports.SessionManager
Expand All @@ -16,11 +15,7 @@ class AuthWithGoogleCaseUse(
) {
suspend operator fun invoke(context: Context): Result<String> = runCatching {
val googleUser = googleAuthProvider.getUser(context)

val password = hashEmailWithSub(
email = googleUser.email,
sub = googleUser.sub
)
val password = googleUser.sub

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 21, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep backward-compatible password derivation for Google login

Switching Google sign-in to password = googleUser.sub breaks every existing Google account created before this commit, because those users were registered with hashEmailWithSub(email, sub) and this flow no longer tries that legacy credential. In AuthWithGoogleCaseUse, the first login attempt now always sends the new password format, so legacy users get 401, then 409 on re-register, and are effectively locked out of one-tap despite having valid accounts.

Useful? React with 👍 / 👎.


runCatching { sessionManager.closeCurrentSession() }

Expand All @@ -31,11 +26,22 @@ class AuthWithGoogleCaseUse(

when(e.code) {
401 -> {
val userId =registerCaseUse(
email = googleUser.email,
password = password,
name = googleUser.name
).getOrElse { throw it }
val userId = try {
registerCaseUse(
email = googleUser.email,
password = password,
name = googleUser.name
).getOrElse { throw it }
} catch (registerError: Exception) {
val appwriteError = registerError as? AppwriteException
if (appwriteError?.code == 409) {
throw IllegalStateException(
"Tu contraseña fue cambiada. " +
"Inicia una vez con correo y contraseña para continuar con Google."
)
}
throw registerError
}

accountRepository.updateProfile(
UserProfile(
Expand All @@ -46,18 +52,9 @@ class AuthWithGoogleCaseUse(
)
)
userId
accountRepository.updateProfile(
UserProfile(
sub = googleUser.sub,
phone = googleUser.phone,
photoUrl = googleUser.photoUrl,
verification = false
)
)
userId
}
else -> throw e
}
}
}
}
}
8 changes: 2 additions & 6 deletions ...main/java/com/elitec/alejotaller/feature/auth/domain/caseuse/RegisterWithGoogleUseCase.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package com.elitec.alejotaller.feature.auth.domain.caseuse

import android.content.Context
import com.elitec.alejotaller.feature.auth.domain.caseuse.util.hashEmailWithSub
import com.elitec.alejotaller.feature.auth.domain.entity.User
import com.elitec.alejotaller.feature.auth.domain.entity.UserProfile
import com.elitec.alejotaller.feature.auth.domain.repositories.AccountRepository
Expand All @@ -18,10 +17,7 @@ class RegisterWithGoogleUseCase(

val googleUser = googleAuthProvider.getUser(context)

val password = hashEmailWithSub(
email = googleUser.email,
sub = googleUser.sub
)
val password = googleUser.sub

val userProfile = UserProfile(
sub = googleUser.sub,
Expand All @@ -46,4 +42,4 @@ class RegisterWithGoogleUseCase(

googleUser.email
}
}
}
Loading