u

src/api/routes/auth/login.js

@@ -13,7 +13,7 @@ const googleClient = new OAuth2Client(env.googleClientId);
 export function register(app, basePath = '') {
     /**
      * @route POST /auth/login
-     * @description Verifies a Google ID token, checks allowlist, and sets an HTTP-only `token` cookie.
+     * @description Verifies a Google ID token, checks allowlist (or creates entry when `IMPLICIT_CREATE=true`), and sets an HTTP-only `token` cookie.
      * @body {string} idToken - Google ID token from Google Identity Services
      * @returns {Object} 200 - `{ message, user }` with `{ id, email, selectedCompanyId, picture? }` in `user`
      * @returns {Object} 400 - Missing token or Google client not configured
@@ -32,10 +32,15 @@ export function register(app, basePath = '') {
                 return res.status(400).json({ error: 'GOOGLE_CLIENT_ID is not configured' });
             }
 
-            const ticket = await googleClient.verifyIdToken({
-                idToken,
-                audience: env.googleClientId,
-            });
+            let ticket;
+            try {
+                ticket = await googleClient.verifyIdToken({
+                    idToken,
+                    audience: env.googleClientId,
+                });
+            } catch {
+                return res.status(401).json({ error: 'Invalid Google token' });
+            }
             const payload = ticket.getPayload();
             const email = payload?.email?.toLowerCase();
 
@@ -43,7 +48,11 @@ export function register(app, basePath = '') {
                 return res.status(401).json({ error: 'Invalid Google account' });
             }
 
-            const allowed = await db.getAllowedEmail(email);
+            let allowed = await db.getAllowedEmail(email);
+            if (!allowed && env.implicitCreate) {
+                await db.addAllowedEmail(email);
+                allowed = await db.getAllowedEmail(email);
+            }
             if (!allowed) {
                 console.warn(`Login rejected: email not authorized (${email})`);
                 return res.status(403).json({ error: 'Email is not authorized' });
@@ -66,7 +75,8 @@ export function register(app, basePath = '') {
 
             res.status(200).json({ message: 'Login successful', user });
         } catch (error) {
-            res.status(401).json({ error: 'Invalid Google token' });
+            console.error('Login failed:', error);
+            res.status(500).json({ error: 'Login failed' });
         }
     });
 }