Skip to content
Flowery

ADR-019: Sign in with Google

Status: accepted 7 October 2026. The owner created a Google Cloud web client and asked for Google sign-in, the biggest remaining saving at sign-up after the onboarding walkthrough.

Context

Section titled “Context”

Sign-up needs a name, an email, a password and a confirmed address before a shop can be created. Most florists already have a Google account on their phone. Email confirmation stays required for password sign-ups (onboarding, 6 October 2026).

Decision

Section titled “Decision”

  1. Laravel Socialite, server-side code flow, on the root domain:

    • GET /auth/google/redirect asks for openid, email and profile only;
    • GET /auth/google/callback comes back from Google.

    Both are for guests, rate-limited, and answer 404 until GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set. The pages show the button only then.

  2. Only addresses Google verified (email_verified). Such an address counts as confirmed, so a Google sign-up goes straight to the shop step.

  3. Which account:

    • By Google id first (users.google_id, Google’s stable sub), so a changed Gmail address still reaches the account.
    • Then by email (case-insensitive), which links the Google id.
    • Otherwise a new account with a random password. The person can set a password through “Forgot password” if they ever want one.

  4. Pre-hijacking is closed. Someone can sign up with another person’s address and never confirm it. When the real owner of that address arrives through Google, the account becomes theirs: its password and remember-me token are replaced, and its sessions are deleted.

  5. Two-factor authentication still applies. An account with confirmed two-factor goes to Fortify’s code challenge (login.id in the session) before it is signed in.

  6. Errors say what to do, in the interface language, on the sign-in page: cancelled, expired, unavailable, address not verified. Provider error text is logged server-side, with the client secret redacted, and never shown.

Consequences

Section titled “Consequences”
  • One Google Cloud client, redirect URI https://flowery.com.ua/auth/google/callback. Google accepts redirect URIs only on public domains, so flowery.test cannot use it; local behaviour is covered by tests with Socialite’s fake (tests/Feature/Auth/GoogleSignInTest.php).
  • While the Google consent screen is in “Testing”, only the test users listed there can sign in. Publishing it needs a home page and a privacy policy page, which the landing page does not have yet.
  • A Google-only account has no password it knows. Changing the password in the settings and deleting the account both ask for the current password, so such a person first sets one through “Forgot password”.
  • The name comes from Google and can be changed in the profile settings. No Google token is stored; the app does not call Google again after sign-in.