Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions app/api/routers/breeze_buddy/signup/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,10 @@
"""

from fastapi import APIRouter, Depends
from pydantic import BaseModel

from app.api.security.breeze_buddy.rbac_token import get_current_user_with_rbac
from app.core.config.static import GOOGLE_CLIENT_ID
from app.schemas import TokenResponse, UserInfo
from app.schemas.breeze_buddy.signup import (
AccountsResponse,
Expand Down Expand Up @@ -112,3 +114,17 @@ async def switch_account(
account_id=request.account_id,
current_user=current_user,
)


class PublicConfigResponse(BaseModel):
google_client_id: str

Comment on lines +119 to +121

@router.get(
"/config",
response_model=PublicConfigResponse,
summary="Public client configuration (Google Client ID, etc.)",
tags=["signup"],
)
async def get_public_config() -> PublicConfigResponse:
return PublicConfigResponse(google_client_id=GOOGLE_CLIENT_ID)
Comment on lines +129 to +130
Comment on lines +129 to +130
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Return a 503 when GOOGLE_CLIENT_ID is unconfigured, consistent with handlers.py.

GOOGLE_CLIENT_ID defaults to "" when the env var is absent (see app/core/config/static.py:352). As written, this endpoint silently returns {"google_client_id": ""}, leaving the frontend to fail later with an opaque Google Sign-In error. _verify_google_id_token in handlers.py raises HTTP 503 in the exact same situation — the /config endpoint should mirror that behaviour so clients can detect and surface the misconfiguration early.

🛡️ Proposed fix
+from fastapi import APIRouter, Depends, HTTPException, status
...
 async def get_public_config() -> PublicConfigResponse:
+    if not GOOGLE_CLIENT_ID:
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Google SSO is not configured on this server.",
+        )
     return PublicConfigResponse(google_client_id=GOOGLE_CLIENT_ID)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/api/routers/breeze_buddy/signup/__init__.py` around lines 129 - 130,
get_public_config currently returns an empty google_client_id when
GOOGLE_CLIENT_ID is unset; update get_public_config to check GOOGLE_CLIENT_ID
and, if it's falsy/empty, raise an HTTP 503 (e.g., via fastapi.HTTPException)
with a clear message mirroring the behavior in _verify_google_id_token in
handlers.py so clients can detect the misconfiguration early; otherwise return
PublicConfigResponse(google_client_id=GOOGLE_CLIENT_ID) as before.

Loading