\r \r

a2a-Market Google OAuth\r

\r Create a stable OAuth integration shell for buyer and merchant sign-in.\r \r Current status: publish-ready scaffold. Keep flows explicit and deterministic before full SSO hardening.\r \r

Scope\r

• Implement Google OAuth authorization code flow.\r
• Link external identity to internal Agent/Operator profile.\r
• Bootstrap session token and refresh workflow after callback.\r \r

Suggested Project Layout\r

• app/integrations/oauth/google_client.py\r
• app/interfaces/api/auth_routes.py\r
• app/application/services/session_service.py\r
• app/protocol/identity/user_identity_mapper.py\r \r

Minimum Contracts (MVP P0)\r

1. GET /auth/google/start builds state + redirect URL.\r
2. GET /auth/google/callback validates state and exchanges code.\r
3. upsert_identity(provider, provider_user_id, email) returns internal principal id.\r
4. create_session(principal_id) returns short-lived access token and refresh token.\r \r

Security Baseline\r

• Validate state and nonce against server-side cache.\r
• Reject callback if issuer/audience do not match configuration.\r
• Store only hashed refresh tokens and rotate on use.\r \r

Events\r

• Emit login event to audit log stream.\r
• Emit session-created event for WebSocket presence bootstrap.\r \r

Implementation Backlog\r

• Add account merge flow for duplicate emails across providers.\r
• Add step-up verification for risky sessions.\r \r

Runtime Implementation\r

• Status: implemented in local runtime package.\r
• Primary code paths:\r
• runtime/src/integrations/oauth/google-oauth-service.js\r
• Validation: covered by runtime/tests and npm test in runtime/.\r