# Google / Apple Sign-In setup

The whole app is gated behind sign-in — nothing is reachable until you sign
in with Google or Apple, no bypass. This is the list of real values you need
to obtain and plug in before it will actually work.

## What was built

- **Identity only.** Signing in shows your name/photo in Settings. It does
  **not** move downloads, playlists, or anything else to the server — all of
  that stays exactly as it is today, fully local on-device.
- The server keeps a minimal user record (id, provider, email, name, avatar)
  in MySQL (see `server/db/schema.sql`'s `users` table — originally a JSON
  file, migrated once the in-app-purchase feature needed a real
  concurrency-safe store; see `docs/PLAN_MONETIZATION.md`).
- Both Google and Apple use **native sign-in modules**
  (`@react-native-google-signin/google-signin` and
  `expo-apple-authentication`, per Expo's current official guides) — **this
  requires a custom dev build, not Expo Go, for both providers.** The app
  can no longer run in Expo Go at all now that login gates everything.
- No Firebase — set up directly against Google Cloud Console / Apple
  Developer.

## 1. Google — three values needed

All three come from the [Google Cloud Console](https://console.cloud.google.com/apis/credentials)
("APIs & Services → Credentials → Create Credentials → OAuth client ID").
Create **two separate OAuth clients**:

### a) "Web application" type client → `webClientId`
This is the one used to get an ID token the server can verify. No redirect
URI needs registering for this one — it's only used as an identifier, not
for a browser redirect.

### b) "iOS" type client → `iosClientId` + `iosUrlScheme`
- Application type: **iOS**. Bundle ID: `com.trentiums.ytdownloadplayer`.
- Google shows you a **reversed client ID** for this one, looking like
  `com.googleusercontent.apps.123456-abcdef`. You need this exact string in
  **two places**:
  1. `my-player/app.json` → find the `@react-native-google-signin/google-signin`
     plugin entry and replace `REPLACE_WITH_IOS_CLIENT_ID_PREFIX` after
     `com.googleusercontent.apps.` with your real value.
  2. `EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID` in `.env` (the plain iOS Client ID,
     not the reversed form — same value Google shows above the reversed one).

### c) Android — needs a client registered, but no code changes
- Application type: **Android**. Package name: `com.trentiums.ytdownloadplayer` (same as iOS's bundle identifier — the two were mismatched earlier and have since been aligned).
- **SHA-1 certificate fingerprint** — for a local dev build, get it with:
  ```bash
  keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android
  ```
  (Run this after your first Android build creates the debug keystore, if
  it doesn't exist yet.) Paste that SHA-1 into the Android OAuth client.
- No client ID needs to go in code for Android — Google matches sign-in
  attempts by package name + SHA-1 automatically.

### Then set these

```
# my-player/.env
EXPO_PUBLIC_GOOGLE_WEB_CLIENT_ID=<the Web client ID>
EXPO_PUBLIC_GOOGLE_IOS_CLIENT_ID=<the iOS client ID>

# server/.env
GOOGLE_CLIENT_ID=<the SAME Web client ID>
```

```json
// my-player/app.json — find this plugin entry and fill in the real value
["@react-native-google-signin/google-signin", {
  "iosUrlScheme": "com.googleusercontent.apps.<your real iOS client ID prefix>"
}]
```

## 2. Apple — no external credential needed, just Developer Portal + rebuild

Apple identity tokens are verified against Apple's own public keys (no
secret key needed on our side). Just enable the capability:

1. [developer.apple.com](https://developer.apple.com/account) → **Certificates, Identifiers & Profiles → Identifiers**.
2. Select the App ID for `com.trentiums.ytdownloadplayer` (or create it if it
   doesn't exist yet).
3. Enable the **Sign In with Apple** capability and save.

`server/.env`'s `APPLE_BUNDLE_ID` already defaults to the correct value —
nothing to change there.

## 3. Rebuild after changing any of the above

Both providers need a fresh native build to pick up config changes (new
`app.json` plugin config, new env vars baked into the native binary):

```bash
cd my-player
npx expo prebuild   # safe/idempotent — regenerates ios/ and android/ from app.json
cd ios && RCT_NEW_ARCH_ENABLED=1 pod install && cd ..   # see gotcha below
npx expo run:ios     # or open ios/*.xcworkspace in Xcode and run from there
```

**Gotcha hit while building this tonight:** `pod install` must be run with
`RCT_NEW_ARCH_ENABLED=1` in the environment, or `@react-native-google-signin/google-signin`'s
native module silently links in old-architecture mode and crashes at
runtime with `TurboModuleRegistry.getEnforcing(...): 'RNGoogleSignin' could
not be found`. If `npx expo run:ios` ever hits this, run the manual
`pod install` command above first, then re-run `expo run:ios --no-install`.

## 4. Verified tonight (iOS Simulator, real dev-client build)

- Login screen renders correctly, gate is unavoidable (confirmed — there's
  no way to reach the app without signing in).
- **Apple Sign-In**: tapping the button correctly invokes the real native
  Apple authentication flow. It fails in Simulator only because Simulator
  itself isn't signed into an Apple ID (`RequestUnknownException` /
  "sign in to your Apple Account in Settings") — this is a Simulator
  limitation, not a bug, and won't happen on your physical device.
- **Google Sign-In**: correctly shows "not configured yet" with no client
  ID set, no crash.
- Real end-to-end sign-in for either provider is untestable until the
  credentials above are filled in.

## 5. Security note

`server/.env`'s `JWT_SECRET` (used to sign this server's own session tokens)
currently has a real random value generated for local dev. If this server
ever gets deployed anywhere reachable outside your machine, generate a fresh
one for that environment: `openssl rand -hex 32`.