> ## Documentation Index
> Fetch the complete documentation index at: https://haico.gr/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Auth

> Login or auto-register with a Google account.

The frontend sends either a Google ID-token (from ``@react-oauth/google``'s
``<GoogleLogin>`` credential field) or an OAuth access-token. The backend
tries ID-token verification first, then falls back to Google's userinfo
endpoint, because different frontend libraries produce different token types.

Account linking logic:
  1. Lookup by ``google_id`` — existing Google-linked account.
  2. Lookup by email — link a pre-existing local account to Google if the
     email addresses match and the local account has no Google ID yet.
  3. Auto-create a new account using the email prefix as the username base.

Args:
    payload: Google credential (ID-token or access-token) and reCAPTCHA token.
    request: The raw HTTP request for IP extraction.
    db:      Database session.

Returns:
    A ``TokenResponse`` with the JWT, expiry, and user profile.

Raises:
    HTTPException 400: CAPTCHA failure or unverified Google email.
    HTTPException 401: Invalid Google credential.
    HTTPException 403: Account disabled.
    HTTPException 409: Email already linked to a different Google account.
    HTTPException 501: Google OAuth not configured on this server.



## OpenAPI

````yaml /openapi.json post /api/auth/google-auth
openapi: 3.1.0
info:
  title: HAI-Co² API
  description: Human-AI Co-Construction reference implementation.
  version: 0.1.0
servers:
  - url: https://haico.gr
    description: Production
  - url: https://dev.haico.gr
    description: Development
  - url: http://localhost:8000
    description: Local development
security: []
paths:
  /api/auth/google-auth:
    post:
      tags:
        - Auth
      summary: Google Auth
      description: >-
        Login or auto-register with a Google account.


        The frontend sends either a Google ID-token (from
        ``@react-oauth/google``'s

        ``<GoogleLogin>`` credential field) or an OAuth access-token. The
        backend

        tries ID-token verification first, then falls back to Google's userinfo

        endpoint, because different frontend libraries produce different token
        types.


        Account linking logic:
          1. Lookup by ``google_id`` — existing Google-linked account.
          2. Lookup by email — link a pre-existing local account to Google if the
             email addresses match and the local account has no Google ID yet.
          3. Auto-create a new account using the email prefix as the username base.

        Args:
            payload: Google credential (ID-token or access-token) and reCAPTCHA token.
            request: The raw HTTP request for IP extraction.
            db:      Database session.

        Returns:
            A ``TokenResponse`` with the JWT, expiry, and user profile.

        Raises:
            HTTPException 400: CAPTCHA failure or unverified Google email.
            HTTPException 401: Invalid Google credential.
            HTTPException 403: Account disabled.
            HTTPException 409: Email already linked to a different Google account.
            HTTPException 501: Google OAuth not configured on this server.
      operationId: google_auth_api_auth_google_auth_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GoogleAuthRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    GoogleAuthRequest:
      properties:
        credential:
          type: string
          minLength: 1
          title: Credential
          description: Google ID-token or access-token
        captcha_token:
          type: string
          title: Captcha Token
          default: ''
      type: object
      required:
        - credential
      title: GoogleAuthRequest
      description: >-
        Google OAuth login request. The credential may be an ID-token or
        access-token.
    TokenResponse:
      properties:
        access_token:
          type: string
          title: Access Token
        token_type:
          type: string
          title: Token Type
          default: bearer
        expires_in:
          type: integer
          title: Expires In
        user:
          $ref: '#/components/schemas/UserResponse'
      type: object
      required:
        - access_token
        - expires_in
        - user
      title: TokenResponse
      description: JWT access-token response returned after successful authentication.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    UserResponse:
      properties:
        id:
          type: integer
          title: Id
        username:
          type: string
          title: Username
        email:
          anyOf:
            - type: string
            - type: 'null'
          title: Email
        role:
          type: string
          title: Role
        is_approved:
          type: boolean
          title: Is Approved
        auth_provider:
          type: string
          title: Auth Provider
        email_verified:
          type: boolean
          title: Email Verified
        created_at:
          type: string
          format: date-time
          title: Created At
        recording_consent_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Recording Consent At
        research_publish_consent_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Research Publish Consent At
        email_updates_opt_in:
          type: boolean
          title: Email Updates Opt In
          default: false
      type: object
      required:
        - id
        - username
        - role
        - is_approved
        - auth_provider
        - email_verified
        - created_at
      title: UserResponse
      description: Public user profile returned by auth endpoints.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError

````