{"record":{"id":"8ac58e0e5853efe2","repo":"Freika/dawarich","slug":"google-client-ids-not-configured","errorCode":null,"errorMessage":"Google client IDs not configured","messagePattern":"Google client IDs not configured","errorType":"exception","errorClass":"Auth::VerifyGoogleToken::InvalidToken","httpStatus":401,"severity":"critical","filePath":"app/services/auth/verify_google_token.rb","lineNumber":20,"sourceCode":"\nmodule Auth\n  class VerifyGoogleToken\n    class InvalidToken < StandardError; end\n\n    def initialize(id_token, nonce: nil)\n      @id_token = id_token\n      @nonce = nonce\n    end\n\n    def call\n      raise InvalidToken, 'blank token' if @id_token.blank?\n\n      client_ids = [\n        ENV['GOOGLE_IOS_CLIENT_ID'],\n        ENV['GOOGLE_ANDROID_CLIENT_ID'],\n        ENV['GOOGLE_OAUTH_CLIENT_ID']\n      ].compact\n      raise InvalidToken, 'Google client IDs not configured' if client_ids.empty?\n\n      validator = GoogleIDToken::Validator.new\n      claims = nil\n      audience_error = nil\n\n      client_ids.each do |client_id|\n        claims = validator.check(@id_token, client_id)\n        break if claims\n      rescue GoogleIDToken::AudienceMismatchError => e\n        audience_error = e\n        next\n      end\n\n      raise InvalidToken, audience_error&.message || 'validator returned nil' if claims.nil?\n\n      claims = claims.symbolize_keys\n      verify_nonce!(claims)\n","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/Freika/dawarich/blob/97fad417c5a11b0eb11157890635e015723a2e97/app/services/auth/verify_google_token.rb#L2-L38","documentation":"Raised by Auth::VerifyGoogleToken#call when none of GOOGLE_IOS_CLIENT_ID, GOOGLE_ANDROID_CLIENT_ID, or GOOGLE_OAUTH_CLIENT_ID is set in the environment. The validator needs at least one audience (OAuth client ID) to check the token against; with zero client IDs there is nothing to validate and the service refuses to proceed rather than accepting a token unverified.","triggerScenarios":"Deploying the app without the GOOGLE_OAUTH_CLIENT_ID env var (or its iOS/Android siblings), running the service in a new environment (staging, CI, container) that was seeded from a partial .env, or a typo in the variable name so all three read nil and .compact yields an empty array.","commonSituations":"Missing/duplicated env var in docker-compose or Kubernetes manifests, values defined only in .env.local so production lacks them, an env var set to an empty string (compact removes nil but blank strings remain — verify they are actually present), rotating Google OAuth client IDs and forgetting to update the deployment.","solutions":["Set GOOGLE_OAUTH_CLIENT_ID (web client) and, if mobile sign-in is used, GOOGLE_IOS_CLIENT_ID / GOOGLE_ANDROID_CLIENT_ID to the OAuth 2.0 client IDs from Google Cloud Console > APIs & Services > Credentials.","Redeploy/restart the app processes (Sidekiq workers and web) so they pick up the new environment.","Verify at runtime: Rails runner 'puts ENV.keys.grep(/GOOGLE_/)' or a boot-time check that raises loudly when the list is empty.","Add the vars to .env.example / CI environment so future environments inherit them."],"exampleFix":"# before: nothing set\n# GOOGLE_OAUTH_CLIENT_ID is unset -> client_ids.compact empty -> raise\n\n# after (docker-compose.yml / deployment env)\nenvironment:\n  GOOGLE_OAUTH_CLIENT_ID: \"1234567890-abc.apps.googleusercontent.com\"\n  GOOGLE_IOS_CLIENT_ID: \"1234567890-ios.apps.googleusercontent.com\"\n  GOOGLE_ANDROID_CLIENT_ID: \"1234567890-and.apps.googleusercontent.com\"","handlingStrategy":"validation","validationCode":"# config/initializers/google_auth.rb\nclient_ids = %w[GOOGLE_IOS_CLIENT_ID GOOGLE_ANDROID_CLIENT_ID GOOGLE_OAUTH_CLIENT_ID].map { |k| ENV[k] }.compact\nif Rails.env.production? && client_ids.empty?\n  Rails.logger.error('No Google client IDs configured - Google sign-in disabled')\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add a boot-time or deploy-time check that at least one GOOGLE_*_CLIENT_ID is set in every environment where sign-in is enabled.","List the vars in .env.example and CI secrets so new environments copy them.","Fail fast in config rather than at first user sign-in."],"tags":["configuration","environment-variables","google-oauth","authentication","ruby"],"backgroundTag":"missing-env-var","analyzedSha":"97fad417c5a11b0eb11157890635e015723a2e97","analyzedAt":"2026-08-21T17:04:17.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}