Create GOOGLE_OAUTH_SETUP.md

GOOGLE_OAUTH_SETUP.md

@@ -0,0 +1,79 @@
+# Google OAuth Setup Guide
+
+This application uses Google OAuth for user authentication. Follow these steps to set it up:
+
+## 1. Create Google OAuth Credentials
+
+1. Go to the [Google Cloud Console](https://console.cloud.google.com/)
+2. Create a new project or select an existing one
+3. Enable the Google+ API
+4. Go to "Credentials" → "Create Credentials" → "OAuth client ID"
+5. Choose "Web application"
+6. Add authorized redirect URIs:
+   - For development: `http://localhost:7860/api/auth/callback`
+   - For production: `https://your-domain.com/api/auth/callback`
+7. Copy the Client ID and Client Secret
+
+## 2. Set Environment Variables
+
+Set the following environment variables:
+
+```bash
+# Google OAuth
+GOOGLE_CLIENT_ID=your-client-id-here
+GOOGLE_CLIENT_SECRET=your-client-secret-here
+
+# JWT Secret (use a strong random string)
+JWT_SECRET_KEY=your-secret-key-here
+
+# Frontend URL (for OAuth redirect)
+FRONTEND_URL=http://localhost:5173  # or your production URL
+```
+
+## 3. Database Migration
+
+The database will automatically create the new `users` table and add `user_id` to the `extractions` table when you start the application.
+
+**Note:** If you have an existing database with extraction records, you'll need to:
+1. Back up your data
+2. Delete the old database file
+3. Restart the application to recreate tables with the new schema
+
+Or manually migrate:
+- Add `user_id` column to `extractions` table (you may need to set a default user_id for existing records)
+
+## 4. Install Dependencies
+
+Make sure to install the new Python dependencies:
+
+```bash
+pip install -r backend/requirements.txt
+```
+
+New dependencies added:
+- `authlib` - OAuth library
+- `pyjwt` - JWT token handling
+- `python-jose[cryptography]` - JWT verification
+
+## 5. Start the Application
+
+1. Start the backend server
+2. Start the frontend development server
+3. Users will be prompted to sign in with Google when they try to access the application
+
+## How It Works
+
+1. User clicks "Sign in with Google" → redirected to Google login
+2. After authentication, Google redirects to `/api/auth/callback`
+3. Backend creates/updates user in database and generates JWT token
+4. Frontend receives token and stores it in localStorage
+5. All API requests include the JWT token in the Authorization header
+6. Backend verifies token and filters data by user_id
+
+## Security Notes
+
+- JWT tokens expire after 7 days
+- Tokens are stored in localStorage (consider httpOnly cookies for production)
+- All extraction records are filtered by user_id
+- Users can only see their own data and history
+