Google sign-in via Supabase (server-side PKCE), feature-flagged

/api/auth/google/{login,callback}: PKCE challenge with the verifier in a
short-lived signed cookie, stdlib-only token exchange, find-or-create
local user by email, same session cookie as password accounts. Button
appears only when SUPABASE_URL + SUPABASE_ANON_KEY are set; Google-only
accounts get a clear message if they try password login. .env template
with placeholders (gitignored) + .env.example updated. 64 tests passing
(5 new, exchange mocked).

.env.example

@@ -43,10 +43,14 @@
 # Force the deterministic fake embedder (never production)
 # CCR_FAKE_EMBEDDINGS=1
 
+# ---- Google sign-in via Supabase (optional; button hidden when unset) ----
+# Supabase dashboard > Project Settings > API. The anon key is public-facing
+# by design; the service_role key is never used and never leaves the dashboard.
+# SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
+# SUPABASE_ANON_KEY=
+# Public base URL of this app (Google redirect target).
+# CCR_APP_URL=http://127.0.0.1:8000
+
 # ---- Phase 2 (not read yet; reserved names) ----
 # DATABASE_URL=postgresql://...
-# SUPABASE_URL=
-# SUPABASE_ANON_KEY=
-# OBJECT_STORAGE_ENDPOINT=
-# OBJECT_STORAGE_BUCKET=
 # ADMIN_EMAILS=devaanand@umass.edu,matari@umass.edu

.gitignore

@@ -16,3 +16,4 @@ node_modules/
 # local AI-tool state (machine-specific)
 .codex/
 .agents/
+.env

DECISIONS.md

@@ -104,3 +104,14 @@ Flipping production to R2 = CCR_STORAGE=s3 + four env values. Rejected: deferrin
 implementation to Phase 2 (turns a deploy-day config flip into deploy-day development),
 and presigned public URLs (private bucket + API streaming is simpler and safer at lab
 scale). Embedding caches deliberately stay on local disk: derived data, no durability need.
+
+## 2026-07-13 - Google sign-in via Supabase PKCE, server-side, feature-flagged (Deva)
+Implemented as a plain redirect flow: /api/auth/google/login sends the browser to
+Supabase's Google authorize URL with a PKCE challenge (verifier in a short-lived signed
+cookie); the callback exchanges the code server-side (stdlib urllib, no new deps), then
+finds-or-creates a local user by email and issues the SAME session cookie as password
+accounts. Inert until SUPABASE_URL + SUPABASE_ANON_KEY are set, so dev/tests need no
+Supabase project. Google-only accounts have no password hash and password login points
+them to the Google button. Rejected: supabase-js in the frontend (breaks the
+react+react-dom-only dependency rule for one button) and provider-JWT sessions (would
+fork the tier/ownership logic into two session formats for no benefit).

backend/app/auth_google.py

@@ -0,0 +1,99 @@
+"""Google sign-in via Supabase Auth (server-side PKCE flow).
+
+Feature-flagged: everything here is inert until SUPABASE_URL and
+SUPABASE_ANON_KEY are set, so local dev and tests run unchanged without any
+Supabase project. When configured, the flow is:
+
+  1. GET /api/auth/google/login   -> redirect to Supabase's Google authorize
+     URL with a PKCE challenge; the verifier rides in a short-lived signed
+     cookie (never stored server-side).
+  2. Google -> Supabase -> GET /api/auth/google/callback?code=...
+  3. The backend exchanges code+verifier for the Supabase user (stdlib
+     urllib - no new dependencies), finds-or-creates a local User row by
+     email, and issues OUR normal session cookie (auth.py).
+
+Design consequence: Supabase verifies identity at sign-in time only; the
+session, tiers, and ownership model are exactly the same as email/password
+accounts. Google users have an empty password_hash and cannot password-login
+(a clear message says to use Google). Because users are re-created on next
+sign-in by email, an ephemeral-disk dev instance losing its SQLite file is a
+nuisance, not a lockout.
+
+No frontend SDK: the button is a plain link, keeping the react+react-dom-only
+dependency rule intact.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import os
+import secrets
+import urllib.error
+import urllib.parse
+import urllib.request
+
+VERIFIER_COOKIE = "ccr_pkce"
+VERIFIER_TTL_SECONDS = 600
+
+
+def configured() -> bool:
+    return bool(os.environ.get("SUPABASE_URL") and os.environ.get("SUPABASE_ANON_KEY"))
+
+
+def _supabase_url() -> str:
+    return os.environ["SUPABASE_URL"].rstrip("/")
+
+
+def app_url() -> str:
+    """Public base URL of THIS app (redirect target). Local default matches
+    the dev server; deployments set CCR_APP_URL."""
+    return os.environ.get("CCR_APP_URL", "http://127.0.0.1:8000").rstrip("/")
+
+
+def begin() -> tuple[str, str]:
+    """Return (authorize_url, code_verifier)."""
+    verifier = secrets.token_urlsafe(64)
+    challenge = (
+        base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest())
+        .decode()
+        .rstrip("=")
+    )
+    params = urllib.parse.urlencode(
+        {
+            "provider": "google",
+            "redirect_to": f"{app_url()}/api/auth/google/callback",
+            "code_challenge": challenge,
+            "code_challenge_method": "s256",
+        }
+    )
+    return f"{_supabase_url()}/auth/v1/authorize?{params}", verifier
+
+
+def exchange(code: str, verifier: str) -> dict:
+    """Exchange the PKCE code for the Supabase user. Returns {email, name}.
+    Raises ValueError with a user-safe message on any failure."""
+    body = json.dumps({"auth_code": code, "code_verifier": verifier}).encode()
+    req = urllib.request.Request(
+        f"{_supabase_url()}/auth/v1/token?grant_type=pkce",
+        data=body,
+        headers={
+            "apikey": os.environ["SUPABASE_ANON_KEY"],
+            "Content-Type": "application/json",
+        },
+        method="POST",
+    )
+    try:
+        with urllib.request.urlopen(req, timeout=15) as resp:
+            payload = json.load(resp)
+    except (urllib.error.URLError, urllib.error.HTTPError, json.JSONDecodeError) as exc:
+        raise ValueError("Google sign-in could not be completed. Please try again.") from exc
+
+    user = payload.get("user") or {}
+    email = (user.get("email") or "").strip().lower()
+    if not email:
+        raise ValueError("Google sign-in returned no email address.")
+    meta = user.get("user_metadata") or {}
+    name = (meta.get("full_name") or meta.get("name") or email.split("@")[0]).strip()
+    return {"email": email, "name": name}

backend/app/main.py

@@ -21,7 +21,7 @@ from fastapi.responses import FileResponse, JSONResponse, PlainTextResponse
 from fastapi.staticfiles import StaticFiles
 from sqlalchemy.orm import Session
 
-from . import auth, retention, storage
+from . import auth, auth_google, retention, storage
 from . import jobs as jobs_module
 from . import registry
 from .ccr import FAKE_MODEL_NAME
@@ -221,6 +221,7 @@ def auth_me(
         "signed_in": False,
         "name": None,
         "email": None,
+        "google_available": auth_google.configured(),
         "limits": {"max_bytes": auth.anon_max_bytes(), "max_rows": auth.anon_max_rows()},
         "usage": {
             "runs_used_today": auth.runs_used_today(request),
@@ -249,12 +250,66 @@ def register(body: RegisterIn, response: Response, db: Session = Depends(get_db)
 def login(body: LoginIn, response: Response, db: Session = Depends(get_db)):
     email = body.email.strip().lower()
     user = db.query(User).filter_by(email=email).first()
+    if user is not None and not user.password_hash:
+        raise HTTPException(401, "This account uses Google sign-in - use the Google button.")
     if user is None or not auth.verify_password(body.password, user.password_hash):
         raise HTTPException(401, "Incorrect email or password.")
     _set_session_cookie(response, user)
     return {"signed_in": True, "name": user.name, "email": user.email}
 
 
+@app.get("/api/auth/google/login")
+def google_login():
+    """Start the Google sign-in flow (Supabase PKCE). Plain redirect - the
+    frontend links here directly, no SDK involved."""
+    if not auth_google.configured():
+        raise HTTPException(503, "Google sign-in is not configured on this instance.")
+    from fastapi.responses import RedirectResponse
+
+    url, verifier = auth_google.begin()
+    resp = RedirectResponse(url, status_code=307)
+    resp.set_cookie(
+        auth_google.VERIFIER_COOKIE,
+        auth.sign_payload({"v": verifier}),
+        httponly=True,
+        samesite="lax",
+        secure=auth.cookies_secure(),
+        max_age=auth_google.VERIFIER_TTL_SECONDS,
+    )
+    return resp
+
+
+@app.get("/api/auth/google/callback")
+def google_callback(request: Request, code: str = "", db: Session = Depends(get_db)):
+    from fastapi.responses import RedirectResponse
+
+    def fail(msg: str):
+        return RedirectResponse(f"/?auth_error={msg}", status_code=307)
+
+    if not auth_google.configured():
+        return fail("google-not-configured")
+    payload = auth.verify_payload(request.cookies.get(auth_google.VERIFIER_COOKIE))
+    if not code or not payload or "v" not in payload:
+        return fail("sign-in-expired-try-again")
+    try:
+        info = auth_google.exchange(code, payload["v"])
+    except ValueError:
+        return fail("google-exchange-failed")
+
+    user = db.query(User).filter_by(email=info["email"]).first()
+    if user is None:
+        # Google-verified account: no local password (password login is refused
+        # with a pointer to the Google button).
+        user = User(email=info["email"], name=info["name"], password_hash="")
+        db.add(user)
+        db.commit()
+
+    resp = RedirectResponse("/", status_code=307)
+    resp.delete_cookie(auth_google.VERIFIER_COOKIE)
+    _set_session_cookie(resp, user)
+    return resp
+
+
 @app.post("/api/auth/logout")
 def logout(response: Response):
     response.delete_cookie(auth.COOKIE_NAME)

backend/static/assets/index-BAVSoV2O.css

@@ -1 +0,0 @@
-:root{--maroon: #7a1f3d;--maroon-dark: #5e1730;--ink: #1d2129;--muted: #667085;--line: #e5e7eb;--bg: #f7f7f8;--card: #ffffff;--ok: #157f3d;--err: #b42318;--accent-soft: #f6ebef;--control-height: 40px}*{box-sizing:border-box}body{margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,sans-serif;color:var(--ink);background:var(--bg);font-size:14.5px;line-height:1.5}.app{display:flex;flex-direction:column;min-height:100vh}.header{background:var(--maroon);color:#fff;padding:14px 28px;display:flex;align-items:baseline;flex-wrap:wrap;gap:14px}.header h1{flex:0 0 auto;font-size:17px;margin:0;font-weight:650;letter-spacing:.2px;white-space:nowrap}.header .sub{flex:1 1 280px;min-width:0;font-size:12.5px;opacity:.85}.layout{display:flex;flex:1;min-width:0;min-height:0}.sidebar{width:250px;background:var(--card);border-right:1px solid var(--line);padding:18px 14px;flex-shrink:0;display:flex;flex-direction:column;min-height:0}.sidebar h2{font-size:11.5px;text-transform:uppercase;letter-spacing:.7px;color:var(--muted);margin:0 0 10px 4px;display:flex;align-items:center;gap:8px}.sidebar h2 .count{background:var(--bg);border:1px solid var(--line);border-radius:999px;padding:0 8px;font-size:10.5px;letter-spacing:0;color:var(--muted)}.sidebar-filter{width:100%;padding:7px 10px;margin-bottom:10px;border:1px solid var(--line);border-radius:8px;font:inherit;font-size:13px;background:#fff;color:var(--ink)}.sidebar-filter:focus{outline:none;border-color:var(--maroon)}.project-list{flex:1;min-height:0;overflow-y:auto;margin:0 -4px;padding:0 4px 4px}.group-label{font-size:10.5px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);margin:10px 4px 5px}div:first-child>.group-label{margin-top:2px}.project-item{display:block;width:100%;text-align:left;padding:9px 12px;margin-bottom:5px;border:1px solid transparent;border-radius:8px;background:none;cursor:pointer;font:inherit;color:var(--ink)}.project-item:hover{background:var(--bg)}.project-item.active{background:var(--accent-soft);border-color:var(--maroon);font-weight:600}.project-item .project-name{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.project-item .date{display:block;font-size:11.5px;color:var(--muted);font-weight:400}.project-create{margin-top:12px;padding-top:12px;border-top:1px solid var(--line)}.project-create>button{width:100%}.main{flex:1;padding:22px 28px;overflow-y:auto;min-width:0}.card{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:18px 20px;margin-bottom:16px}.card h3{margin:0 0 4px;font-size:15px}.card .hint{color:var(--muted);font-size:12.5px;margin:0 0 12px}.step-badge{display:inline-flex;align-items:center;justify-content:center;width:21px;height:21px;border-radius:50%;background:var(--maroon);color:#fff;font-size:12px;font-weight:700;margin-right:8px;vertical-align:-3px}button{white-space:nowrap}button.primary{background:var(--maroon);color:#fff;border:none;min-height:var(--control-height);display:inline-flex;align-items:center;justify-content:center;padding:0 18px;border-radius:8px;font:inherit;font-weight:600;cursor:pointer;line-height:1.2}button.primary:hover{background:var(--maroon-dark)}button.primary:disabled{background:#c9ccd1;cursor:not-allowed}button.ghost{background:none;border:1px solid var(--line);color:var(--ink);min-height:var(--control-height);display:inline-flex;align-items:center;justify-content:center;padding:0 14px;border-radius:8px;font:inherit;cursor:pointer;line-height:1.2}button.ghost:hover{border-color:var(--maroon);color:var(--maroon)}button.linkish{background:none;border:none;color:var(--maroon);font:inherit;cursor:pointer;padding:0;text-decoration:underline}input[type=text],input[type=email],input[type=password],textarea,select{width:100%;padding:8px 10px;border:1px solid var(--line);border-radius:8px;font:inherit;background:#fff;color:var(--ink)}input[type=text],input[type=email],input[type=password],select{height:var(--control-height)}button:focus-visible,input:focus-visible,textarea:focus-visible,select:focus-visible{outline:2px solid rgba(122,31,61,.38);outline-offset:2px}input[type=file]{display:block;max-width:100%;margin-top:6px;font-size:13px;color:var(--muted)}input[type=file]::file-selector-button{background:#fff;border:1px solid var(--line);color:var(--ink);padding:7px 14px;border-radius:8px;font:inherit;font-size:13px;cursor:pointer;margin-right:10px}input[type=file]::file-selector-button:hover{border-color:var(--maroon);color:var(--maroon)}.row>button{align-self:flex-end;margin-bottom:1px}textarea{resize:vertical}label.field{display:block;margin-bottom:10px;font-size:13px;font-weight:600}label.field>*{margin-top:4px;font-weight:400}.field-hint{margin-top:0;font-weight:400;color:var(--muted);font-size:12px}.row{display:flex;gap:14px;flex-wrap:wrap}.row>*{min-width:0}.row>.grow{flex:1;min-width:min(220px,100%)}.language-control{min-width:170px}.model-control{min-width:260px}.run-settings{display:grid;grid-template-columns:minmax(160px,230px) minmax(320px,720px) max-content;justify-content:start;gap:14px;align-items:end}.run-settings .field{margin-bottom:0}.run-button{min-width:180px;height:var(--control-height)}.construct-row{display:grid;grid-template-columns:minmax(320px,1120px) max-content;justify-content:start;align-items:end;gap:14px}.results-toolbar{display:flex;align-items:center;justify-content:space-between;gap:14px;margin-bottom:14px;flex-wrap:wrap}.result-actions{justify-content:flex-end}.result-actions a{display:inline-flex;text-decoration:none}.pill{display:inline-block;padding:2px 10px;border-radius:999px;font-size:11.5px;font-weight:600}.pill.completed{background:#e6f4ea;color:var(--ok)}.pill.running{background:#fff3e0;color:#b45309}.pill.queued{background:#eef2f7;color:var(--muted)}.pill.failed{background:#fdecea;color:var(--err)}.progress-track{background:var(--line);border-radius:999px;height:7px;overflow:hidden}.progress-fill{background:var(--maroon);height:100%;transition:width .4s ease}.warnings{background:#fff8e6;border:1px solid #f2dfa8;color:#7a5b00;border-radius:8px;padding:10px 14px}.error-banner{background:#fdecea;color:var(--err);border:1px solid #f5c6c0;padding:10px 14px;border-radius:8px;margin-bottom:14px;font-size:13px}.table-wrap{width:100%;overflow-x:auto}table.docs{width:100%;border-collapse:collapse;font-size:13px}table.docs th{text-align:left;color:var(--muted);font-size:11.5px;text-transform:uppercase;letter-spacing:.5px;padding:6px 8px;border-bottom:1px solid var(--line)}table.docs td{padding:7px 8px;border-bottom:1px solid var(--bg);vertical-align:top;overflow-wrap:anywhere}table.docs td.score{font-variant-numeric:tabular-nums;font-weight:600;white-space:nowrap}.stat-grid{display:flex;gap:12px;flex-wrap:wrap;margin-bottom:4px}.stat{flex:1;min-width:110px;background:var(--bg);border-radius:8px;padding:10px 14px}.stat .v{font-size:20px;font-weight:700;font-variant-numeric:tabular-nums}.stat .k{font-size:11.5px;color:var(--muted);text-transform:uppercase;letter-spacing:.5px}.item-bar-row{display:flex;align-items:center;gap:10px;margin-bottom:7px}.item-bar-label{flex:1;font-size:12.5px;min-width:0;overflow-wrap:anywhere}.item-bar-track{flex:1.2;background:var(--bg);border-radius:999px;height:10px}.item-bar-fill{background:var(--maroon);opacity:.85;height:100%;border-radius:999px}.item-bar-val{width:52px;text-align:right;font-variant-numeric:tabular-nums;font-size:12.5px;font-weight:600}.construct-items{margin:8px 0 0;padding-left:20px;color:var(--muted);font-size:12.5px}.construct-items li{margin-bottom:2px}.meta-footer{font-size:12px;color:var(--muted);background:var(--bg);border-radius:8px;padding:10px 14px;margin-top:14px;font-variant-numeric:tabular-nums}.meta-footer code{font-size:11.5px}.muted{color:var(--muted)}.small{font-size:12.5px}.mt{margin-top:12px}.header-auth{margin-left:auto;display:flex;align-items:center;gap:10px;color:#fff}.header-btn{background:#ffffff1f;color:#fff;border:1px solid rgba(255,255,255,.45);padding:5px 14px;border-radius:7px;font:inherit;font-size:13px;cursor:pointer}.header-btn:hover{background:#ffffff38}.project-header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:14px;flex-wrap:wrap}.project-title{font-size:17px;font-weight:650;margin-right:10px}button.danger{color:var(--err);border-color:#f0c4be}button.danger:hover{color:var(--err);border-color:var(--err)}button.danger-solid{background:var(--err)}button.danger-solid:hover{background:#93261b}button.danger-solid:disabled{background:#c9ccd1}.picker{position:relative}.picker-display{width:100%;display:flex;align-items:center;gap:10px;padding:8px 12px;border:1px solid var(--line);border-radius:8px;background:#fff;font:inherit;color:var(--ink);cursor:pointer;text-align:left}.picker-display:hover{border-color:var(--maroon)}.picker-display .picker-caret{margin-left:auto;color:var(--muted);font-size:11px}.picker-search{width:100%;padding:8px 12px;border:1px solid var(--maroon);border-radius:8px;font:inherit;background:#fff}.picker-search:focus{outline:none;box-shadow:0 0 0 3px #7a1f3d1f}.picker-panel{position:absolute;top:calc(100% + 6px);left:0;z-index:50;width:100%;max-width:640px;background:var(--card);border:1px solid var(--line);border-radius:10px;box-shadow:0 14px 40px #0000002e;max-height:340px;overflow-y:auto;padding:4px 0 6px}.picker-group{font-size:10.5px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);padding:8px 12px 3px;position:sticky;top:0;background:var(--card)}.picker-option{display:flex;align-items:baseline;justify-content:space-between;gap:12px;padding:6px 12px;cursor:pointer;font-size:13.5px}.picker-option:hover,.picker-option.active{background:var(--accent-soft)}.picker-option.selected .picker-name{font-weight:650;color:var(--maroon)}.picker-name{min-width:0}.picker-meta{flex-shrink:0;font-size:11.5px;color:var(--muted);white-space:nowrap}.picker-empty{padding:12px;margin:0}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#14161a73;display:flex;align-items:center;justify-content:center;z-index:40;padding:16px}.modal{background:var(--card);border-radius:12px;padding:26px 28px 24px;width:100%;max-width:460px;box-shadow:0 12px 40px #0000002e}.modal h3{margin:0 0 8px;font-size:18px}.modal .hint{color:var(--muted);font-size:13px;line-height:1.5;margin:0 0 4px}.modal form.mt{margin-top:18px}.modal label.field{margin-bottom:16px}.modal label.field:last-of-type{margin-bottom:20px}.modal .row{gap:10px}.modal .row>.primary{flex:1}.modal p.small.muted.mt{margin-top:18px;padding-top:16px;border-top:1px solid var(--line);font-size:12.5px;line-height:1.6}@media (max-width: 820px){body{font-size:14px}.header{padding:12px 16px;align-items:flex-start;gap:2px 12px}.header h1{font-size:16px}.header .sub{flex:1 1 210px;font-size:12px;line-height:1.35}.layout{display:block}.sidebar{width:100%;border-right:0;border-bottom:1px solid var(--line);padding:14px}.project-list{max-height:220px;margin-right:0;flex:none}.project-create{border-top:0}.main{width:100%;padding:16px 14px 28px;overflow:visible}.card{padding:16px;margin-bottom:14px}.row,.run-settings,.construct-row,.results-toolbar,.result-actions{gap:10px}.row,.results-toolbar,.result-actions{flex-direction:column;align-items:stretch}.run-settings,.construct-row{grid-template-columns:1fr}.row>.grow,.construct-row>.grow,.language-control,.model-control{width:100%;min-width:0}.main .row>button,.main .row>a,.main .row>a>button,.results-toolbar>button{align-self:stretch;margin-bottom:0;width:100%}.run-button{width:100%;min-width:0}.stat-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr))}.stat{min-width:0}.item-bar-row{display:grid;grid-template-columns:minmax(0,1fr) 56px;gap:6px 10px}.item-bar-track{grid-column:1 / -1;width:100%}.item-bar-val{width:auto}table.docs{min-width:520px}}@media (max-width: 460px){.header .sub{flex-basis:100%}.stat-grid{grid-template-columns:1fr}}

backend/static/assets/index-CN_FzJfm.css

@@ -0,0 +1 @@
+:root{--maroon: #7a1f3d;--maroon-dark: #5e1730;--ink: #1d2129;--muted: #667085;--line: #e5e7eb;--bg: #f7f7f8;--card: #ffffff;--ok: #157f3d;--err: #b42318;--accent-soft: #f6ebef;--control-height: 40px}*{box-sizing:border-box}body{margin:0;font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,sans-serif;color:var(--ink);background:var(--bg);font-size:14.5px;line-height:1.5}.app{display:flex;flex-direction:column;min-height:100vh}.header{background:var(--maroon);color:#fff;padding:14px 28px;display:flex;align-items:baseline;flex-wrap:wrap;gap:14px}.header h1{flex:0 0 auto;font-size:17px;margin:0;font-weight:650;letter-spacing:.2px;white-space:nowrap}.header .sub{flex:1 1 280px;min-width:0;font-size:12.5px;opacity:.85}.layout{display:flex;flex:1;min-width:0;min-height:0}.sidebar{width:250px;background:var(--card);border-right:1px solid var(--line);padding:18px 14px;flex-shrink:0;display:flex;flex-direction:column;min-height:0}.sidebar h2{font-size:11.5px;text-transform:uppercase;letter-spacing:.7px;color:var(--muted);margin:0 0 10px 4px;display:flex;align-items:center;gap:8px}.sidebar h2 .count{background:var(--bg);border:1px solid var(--line);border-radius:999px;padding:0 8px;font-size:10.5px;letter-spacing:0;color:var(--muted)}.sidebar-filter{width:100%;padding:7px 10px;margin-bottom:10px;border:1px solid var(--line);border-radius:8px;font:inherit;font-size:13px;background:#fff;color:var(--ink)}.sidebar-filter:focus{outline:none;border-color:var(--maroon)}.project-list{flex:1;min-height:0;overflow-y:auto;margin:0 -4px;padding:0 4px 4px}.group-label{font-size:10.5px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);margin:10px 4px 5px}div:first-child>.group-label{margin-top:2px}.project-item{display:block;width:100%;text-align:left;padding:9px 12px;margin-bottom:5px;border:1px solid transparent;border-radius:8px;background:none;cursor:pointer;font:inherit;color:var(--ink)}.project-item:hover{background:var(--bg)}.project-item.active{background:var(--accent-soft);border-color:var(--maroon);font-weight:600}.project-item .project-name{display:block;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.project-item .date{display:block;font-size:11.5px;color:var(--muted);font-weight:400}.project-create{margin-top:12px;padding-top:12px;border-top:1px solid var(--line)}.project-create>button{width:100%}.main{flex:1;padding:22px 28px;overflow-y:auto;min-width:0}.card{background:var(--card);border:1px solid var(--line);border-radius:8px;padding:18px 20px;margin-bottom:16px}.card h3{margin:0 0 4px;font-size:15px}.card .hint{color:var(--muted);font-size:12.5px;margin:0 0 12px}.step-badge{display:inline-flex;align-items:center;justify-content:center;width:21px;height:21px;border-radius:50%;background:var(--maroon);color:#fff;font-size:12px;font-weight:700;margin-right:8px;vertical-align:-3px}button{white-space:nowrap}button.primary{background:var(--maroon);color:#fff;border:none;min-height:var(--control-height);display:inline-flex;align-items:center;justify-content:center;padding:0 18px;border-radius:8px;font:inherit;font-weight:600;cursor:pointer;line-height:1.2}button.primary:hover{background:var(--maroon-dark)}button.primary:disabled{background:#c9ccd1;cursor:not-allowed}a.google-btn{background:var(--maroon);color:#fff;border:none;min-height:var(--control-height);display:flex;align-items:center;justify-content:center;padding:0 18px;border-radius:8px;font:inherit;font-weight:600;cursor:pointer;line-height:1.2;text-decoration:none;width:100%;box-sizing:border-box}a.google-btn:hover{background:var(--maroon-dark)}button.ghost{background:none;border:1px solid var(--line);color:var(--ink);min-height:var(--control-height);display:inline-flex;align-items:center;justify-content:center;padding:0 14px;border-radius:8px;font:inherit;cursor:pointer;line-height:1.2}button.ghost:hover{border-color:var(--maroon);color:var(--maroon)}button.linkish{background:none;border:none;color:var(--maroon);font:inherit;cursor:pointer;padding:0;text-decoration:underline}input[type=text],input[type=email],input[type=password],textarea,select{width:100%;padding:8px 10px;border:1px solid var(--line);border-radius:8px;font:inherit;background:#fff;color:var(--ink)}input[type=text],input[type=email],input[type=password],select{height:var(--control-height)}button:focus-visible,input:focus-visible,textarea:focus-visible,select:focus-visible{outline:2px solid rgba(122,31,61,.38);outline-offset:2px}input[type=file]{display:block;max-width:100%;margin-top:6px;font-size:13px;color:var(--muted)}input[type=file]::file-selector-button{background:#fff;border:1px solid var(--line);color:var(--ink);padding:7px 14px;border-radius:8px;font:inherit;font-size:13px;cursor:pointer;margin-right:10px}input[type=file]::file-selector-button:hover{border-color:var(--maroon);color:var(--maroon)}.row>button{align-self:flex-end;margin-bottom:1px}textarea{resize:vertical}label.field{display:block;margin-bottom:10px;font-size:13px;font-weight:600}label.field>*{margin-top:4px;font-weight:400}.field-hint{margin-top:0;font-weight:400;color:var(--muted);font-size:12px}.row{display:flex;gap:14px;flex-wrap:wrap}.row>*{min-width:0}.row>.grow{flex:1;min-width:min(220px,100%)}.language-control{min-width:170px}.model-control{min-width:260px}.run-settings{display:grid;grid-template-columns:minmax(160px,230px) minmax(320px,720px) max-content;justify-content:start;gap:14px;align-items:end}.run-settings .field{margin-bottom:0}.run-button{min-width:180px;height:var(--control-height)}.construct-row{display:grid;grid-template-columns:minmax(320px,1120px) max-content;justify-content:start;align-items:end;gap:14px}.results-toolbar{display:flex;align-items:center;justify-content:space-between;gap:14px;margin-bottom:14px;flex-wrap:wrap}.result-actions{justify-content:flex-end}.result-actions a{display:inline-flex;text-decoration:none}.pill{display:inline-block;padding:2px 10px;border-radius:999px;font-size:11.5px;font-weight:600}.pill.completed{background:#e6f4ea;color:var(--ok)}.pill.running{background:#fff3e0;color:#b45309}.pill.queued{background:#eef2f7;color:var(--muted)}.pill.failed{background:#fdecea;color:var(--err)}.progress-track{background:var(--line);border-radius:999px;height:7px;overflow:hidden}.progress-fill{background:var(--maroon);height:100%;transition:width .4s ease}.warnings{background:#fff8e6;border:1px solid #f2dfa8;color:#7a5b00;border-radius:8px;padding:10px 14px}.error-banner{background:#fdecea;color:var(--err);border:1px solid #f5c6c0;padding:10px 14px;border-radius:8px;margin-bottom:14px;font-size:13px}.table-wrap{width:100%;overflow-x:auto}table.docs{width:100%;border-collapse:collapse;font-size:13px}table.docs th{text-align:left;color:var(--muted);font-size:11.5px;text-transform:uppercase;letter-spacing:.5px;padding:6px 8px;border-bottom:1px solid var(--line)}table.docs td{padding:7px 8px;border-bottom:1px solid var(--bg);vertical-align:top;overflow-wrap:anywhere}table.docs td.score{font-variant-numeric:tabular-nums;font-weight:600;white-space:nowrap}.stat-grid{display:flex;gap:12px;flex-wrap:wrap;margin-bottom:4px}.stat{flex:1;min-width:110px;background:var(--bg);border-radius:8px;padding:10px 14px}.stat .v{font-size:20px;font-weight:700;font-variant-numeric:tabular-nums}.stat .k{font-size:11.5px;color:var(--muted);text-transform:uppercase;letter-spacing:.5px}.item-bar-row{display:flex;align-items:center;gap:10px;margin-bottom:7px}.item-bar-label{flex:1;font-size:12.5px;min-width:0;overflow-wrap:anywhere}.item-bar-track{flex:1.2;background:var(--bg);border-radius:999px;height:10px}.item-bar-fill{background:var(--maroon);opacity:.85;height:100%;border-radius:999px}.item-bar-val{width:52px;text-align:right;font-variant-numeric:tabular-nums;font-size:12.5px;font-weight:600}.construct-items{margin:8px 0 0;padding-left:20px;color:var(--muted);font-size:12.5px}.construct-items li{margin-bottom:2px}.meta-footer{font-size:12px;color:var(--muted);background:var(--bg);border-radius:8px;padding:10px 14px;margin-top:14px;font-variant-numeric:tabular-nums}.meta-footer code{font-size:11.5px}.muted{color:var(--muted)}.small{font-size:12.5px}.mt{margin-top:12px}.header-auth{margin-left:auto;display:flex;align-items:center;gap:10px;color:#fff}.header-btn{background:#ffffff1f;color:#fff;border:1px solid rgba(255,255,255,.45);padding:5px 14px;border-radius:7px;font:inherit;font-size:13px;cursor:pointer}.header-btn:hover{background:#ffffff38}.project-header{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:14px;flex-wrap:wrap}.project-title{font-size:17px;font-weight:650;margin-right:10px}button.danger{color:var(--err);border-color:#f0c4be}button.danger:hover{color:var(--err);border-color:var(--err)}button.danger-solid{background:var(--err)}button.danger-solid:hover{background:#93261b}button.danger-solid:disabled{background:#c9ccd1}.picker{position:relative}.picker-display{width:100%;display:flex;align-items:center;gap:10px;padding:8px 12px;border:1px solid var(--line);border-radius:8px;background:#fff;font:inherit;color:var(--ink);cursor:pointer;text-align:left}.picker-display:hover{border-color:var(--maroon)}.picker-display .picker-caret{margin-left:auto;color:var(--muted);font-size:11px}.picker-search{width:100%;padding:8px 12px;border:1px solid var(--maroon);border-radius:8px;font:inherit;background:#fff}.picker-search:focus{outline:none;box-shadow:0 0 0 3px #7a1f3d1f}.picker-panel{position:absolute;top:calc(100% + 6px);left:0;z-index:50;width:100%;max-width:640px;background:var(--card);border:1px solid var(--line);border-radius:10px;box-shadow:0 14px 40px #0000002e;max-height:340px;overflow-y:auto;padding:4px 0 6px}.picker-group{font-size:10.5px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);padding:8px 12px 3px;position:sticky;top:0;background:var(--card)}.picker-option{display:flex;align-items:baseline;justify-content:space-between;gap:12px;padding:6px 12px;cursor:pointer;font-size:13.5px}.picker-option:hover,.picker-option.active{background:var(--accent-soft)}.picker-option.selected .picker-name{font-weight:650;color:var(--maroon)}.picker-name{min-width:0}.picker-meta{flex-shrink:0;font-size:11.5px;color:var(--muted);white-space:nowrap}.picker-empty{padding:12px;margin:0}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#14161a73;display:flex;align-items:center;justify-content:center;z-index:40;padding:16px}.modal{background:var(--card);border-radius:12px;padding:26px 28px 24px;width:100%;max-width:460px;box-shadow:0 12px 40px #0000002e}.modal h3{margin:0 0 8px;font-size:18px}.modal .hint{color:var(--muted);font-size:13px;line-height:1.5;margin:0 0 4px}.modal form.mt{margin-top:18px}.modal label.field{margin-bottom:16px}.modal label.field:last-of-type{margin-bottom:20px}.modal .row{gap:10px}.modal .row>.primary{flex:1}.modal p.small.muted.mt{margin-top:18px;padding-top:16px;border-top:1px solid var(--line);font-size:12.5px;line-height:1.6}@media (max-width: 820px){body{font-size:14px}.header{padding:12px 16px;align-items:flex-start;gap:2px 12px}.header h1{font-size:16px}.header .sub{flex:1 1 210px;font-size:12px;line-height:1.35}.layout{display:block}.sidebar{width:100%;border-right:0;border-bottom:1px solid var(--line);padding:14px}.project-list{max-height:220px;margin-right:0;flex:none}.project-create{border-top:0}.main{width:100%;padding:16px 14px 28px;overflow:visible}.card{padding:16px;margin-bottom:14px}.row,.run-settings,.construct-row,.results-toolbar,.result-actions{gap:10px}.row,.results-toolbar,.result-actions{flex-direction:column;align-items:stretch}.run-settings,.construct-row{grid-template-columns:1fr}.row>.grow,.construct-row>.grow,.language-control,.model-control{width:100%;min-width:0}.main .row>button,.main .row>a,.main .row>a>button,.results-toolbar>button{align-self:stretch;margin-bottom:0;width:100%}.run-button{width:100%;min-width:0}.stat-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr))}.stat{min-width:0}.item-bar-row{display:grid;grid-template-columns:minmax(0,1fr) 56px;gap:6px 10px}.item-bar-track{grid-column:1 / -1;width:100%}.item-bar-val{width:auto}table.docs{min-width:520px}}@media (max-width: 460px){.header .sub{flex-basis:100%}.stat-grid{grid-template-columns:1fr}}

backend/static/index.html

@@ -4,8 +4,8 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>CCR Platform - Contextualized Construct Representations</title>
-    <script type="module" crossorigin src="/assets/index-UnZRNG5I.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BAVSoV2O.css">
+    <script type="module" crossorigin src="/assets/index-DrFcy6bH.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CN_FzJfm.css">
   </head>
   <body>
     <div id="root"></div>

backend/tests/test_google_auth.py

@@ -0,0 +1,89 @@
+"""Google sign-in (Supabase PKCE): feature flag, redirect flow, callback
+find-or-create, and password-login guard for Google-only accounts. The
+Supabase exchange itself is mocked - no network in tests."""
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app import auth, auth_google
+from app.main import app
+
+
+@pytest.fixture()
+def client():
+    with TestClient(app) as c:
+        yield c
+
+
+@pytest.fixture()
+def google_env(monkeypatch):
+    monkeypatch.setenv("SUPABASE_URL", "https://fakeproj.supabase.co")
+    monkeypatch.setenv("SUPABASE_ANON_KEY", "fake-anon-key")
+    monkeypatch.setenv("CCR_APP_URL", "http://testserver")
+
+
+def test_unconfigured_instance_hides_and_refuses_google(client):
+    assert client.get("/api/auth/me").json().get("google_available") is False
+    assert client.get("/api/auth/google/login", follow_redirects=False).status_code == 503
+
+
+def test_login_redirects_to_supabase_with_pkce(client, google_env):
+    me = client.get("/api/auth/me").json()
+    assert me["google_available"] is True
+
+    resp = client.get("/api/auth/google/login", follow_redirects=False)
+    assert resp.status_code == 307
+    loc = resp.headers["location"]
+    assert loc.startswith("https://fakeproj.supabase.co/auth/v1/authorize?")
+    assert "provider=google" in loc
+    assert "code_challenge=" in loc and "code_challenge_method=s256" in loc
+    assert "redirect_to=http%3A%2F%2Ftestserver%2Fapi%2Fauth%2Fgoogle%2Fcallback" in loc
+    assert auth_google.VERIFIER_COOKIE in resp.cookies
+
+
+def test_callback_creates_user_and_signs_in(client, google_env, monkeypatch):
+    monkeypatch.setattr(
+        auth_google, "exchange",
+        lambda code, verifier: {"email": "pi@lab.edu", "name": "The PI"},
+    )
+    client.cookies.set(auth_google.VERIFIER_COOKIE, auth.sign_payload({"v": "verifier123"}))
+
+    resp = client.get("/api/auth/google/callback?code=abc", follow_redirects=False)
+    assert resp.status_code == 307 and resp.headers["location"] == "/"
+
+    me = client.get("/api/auth/me").json()
+    assert me["signed_in"] is True and me["email"] == "pi@lab.edu" and me["name"] == "The PI"
+
+    # second sign-in reuses the same account (no duplicate users)
+    client.cookies.set(auth_google.VERIFIER_COOKIE, auth.sign_payload({"v": "verifier456"}))
+    client.get("/api/auth/google/callback?code=def", follow_redirects=False)
+    from app.db import SessionLocal
+    from app.models import User
+
+    db = SessionLocal()
+    try:
+        assert db.query(User).filter_by(email="pi@lab.edu").count() == 1
+    finally:
+        db.close()
+
+
+def test_callback_without_verifier_fails_safely(client, google_env):
+    resp = client.get("/api/auth/google/callback?code=abc", follow_redirects=False)
+    assert resp.status_code == 307
+    assert "auth_error=" in resp.headers["location"]
+
+
+def test_google_only_account_cannot_password_login(client, google_env, monkeypatch):
+    monkeypatch.setattr(
+        auth_google, "exchange",
+        lambda code, verifier: {"email": "gonly@lab.edu", "name": "G Only"},
+    )
+    client.cookies.set(auth_google.VERIFIER_COOKIE, auth.sign_payload({"v": "v1"}))
+    client.get("/api/auth/google/callback?code=abc", follow_redirects=False)
+    client.post("/api/auth/logout")
+
+    resp = client.post(
+        "/api/auth/login", json={"email": "gonly@lab.edu", "password": "password123"}
+    )
+    assert resp.status_code == 401
+    assert "Google" in resp.json()["detail"]

frontend/src/App.jsx

@@ -60,6 +60,13 @@ export default function App() {
   useEffect(() => {
     loadProjects();
     loadAuth();
+    // Surface Google sign-in failures passed back via redirect.
+    const params = new URLSearchParams(window.location.search);
+    const authFail = params.get("auth_error");
+    if (authFail) {
+      setError(`Sign-in problem: ${authFail.replaceAll("-", " ")}.`);
+      window.history.replaceState({}, "", "/");
+    }
   }, []);
 
   async function handleAuthSubmit(e) {
@@ -158,6 +165,16 @@ export default function App() {
               and keeps your datasets and runs instead of deleting them after analysis.
             </p>
             {authError && <p className="small" style={{ color: "var(--danger, #b3261e)" }}>{authError}</p>}
+            {auth?.google_available && (
+              <>
+                <a className="primary google-btn" href="/api/auth/google/login">
+                  Continue with Google
+                </a>
+                <p className="small muted" style={{ textAlign: "center", margin: "8px 0" }}>
+                  or use email and password
+                </p>
+              </>
+            )}
             <form onSubmit={handleAuthSubmit} className="mt">
               {authMode === "register" && (
                 <label className="field">
@@ -226,7 +243,9 @@ export default function App() {
                   </button>
                 </>
               )}
-              {" "}· Google sign-in arrives with lab accounts. Forgot your password? Contact the lab admin.
+              {auth?.google_available
+                ? " · Forgot your password? Contact the lab admin, or use Google."
+                : " · Google sign-in arrives with lab accounts. Forgot your password? Contact the lab admin."}
             </p>
           </div>
         </div>

frontend/src/styles.css

@@ -138,6 +138,15 @@ button.primary {
 }
 button.primary:hover { background: var(--maroon-dark); }
 button.primary:disabled { background: #c9ccd1; cursor: not-allowed; }
+a.google-btn {
+  background: var(--maroon); color: #fff; border: none;
+  min-height: var(--control-height);
+  display: flex; align-items: center; justify-content: center;
+  padding: 0 18px; border-radius: 8px; font: inherit; font-weight: 600;
+  cursor: pointer; line-height: 1.2; text-decoration: none; width: 100%;
+  box-sizing: border-box;
+}
+a.google-btn:hover { background: var(--maroon-dark); }
 button.ghost {
   background: none; border: 1px solid var(--line); color: var(--ink);
   min-height: var(--control-height);