ready to test

Testing

Signed-off-by: Kenneth Obsequio <k80308392@gmail.com>

TODO

@@ -0,0 +1,24 @@
+  The good news — no Google verification required for the scopes we use (openid email profile). Verification is only mandatory for sensitive scopes
+  like Gmail or Drive access. Basic OIDC login is exempt.
+
+  What you DO need for production:
+
+  1. Publish the app (remove testing restriction)
+  - Google Auth Platform → Audience → change from Testing to Production
+  - Right now only manually added test users can log in — publishing removes that limit
+
+  2. Add production URIs to the OAuth client
+  - Authorized JavaScript origins: add https://yourdomain.com and https://api.yourdomain.com
+  - Authorized redirect URIs: add https://api.yourdomain.com/api/auth/google/callback
+
+  3. Update production .env
+  GOOGLE_CALLBACK_URL=https://api.yourdomain.com/api/auth/google/callback
+  FRONTEND_URL=https://yourdomain.com
+
+  4. HTTPS is required — Google won't allow http:// redirect URIs in production (localhost is the only exception). Your production server needs SSL,
+  which you likely already have via Nginx.
+
+  5. Add Privacy Policy URL to the branding page — Google requires it when the app is published (even without verification). A simple /privacy page on
+  your frontend is enough.
+
+  That's the full checklist. The localhost dev setup stays untouched alongside the production URIs — Google allows multiple redirect URIs per client.