fix(auth): prefer canonical Google OAuth env names

[Copilot]

Canonical issue

Outcome

Canonical Google OAuth variables now take precedence without breaking Vercel environments still using legacy names. Production credential, redirect URI, and real callback verification remain protected operator actions.

Scope

• Included:
  • Prefer GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET.
  • Retain GOOGLE_OAUTH_* as temporary fallbacks.
  • Add precedence regression coverage and migration guidance.
• Explicitly excluded:
  • Vercel credential changes, Google Cloud redirect updates, deployment, and live sign-in verification.

process.env.GOOGLE_CLIENT_ID ||
process.env.GOOGLE_OAUTH_CLIENT_ID

Risk

• Risk level: low
• Failure mode: canonical variables are absent; legacy fallback continues to supply configuration.
• Rollback: revert the environment lookup ordering.

Verification

Focused test run on 35dd63bdf33707cd7de5e57ce9d939447dc308c2.

• Focused tests: npm --prefix apps/web test -- --run src/lib/__tests__/auth-config-source.test.ts
• Required CI
• Review threads resolved

Production evidence

Not applicable to this code-only change. Protected production verification requires canonical Vercel variables, redirect URI https://uvai.io/api/auth/callback/google, a deployed main SHA, and a real Google callback.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Execution: verify Google OAuth in Vercel production (PR #903) #900

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:50pm UTC