Minor Changes
- 6762a83: Google sign-in facilitator, authorization-code + PKCE (#1775).
GoogleOAuthAdapterbuilds the authorize URL with an S256 challenge, remembers where the user was heading, validatesstateon the way back, and hands the code to your backend — which redeems it with the client secret and issues its own session. qdadm never validates a Google credential in the browser: there is deliberately no code path from a provider response to a session without your backend, because decoding a JWT client-side proves nothing. The backend contract is an open HTTP shape (POST→{ token, user }), sonew GoogleOAuthAdapter({ clientId, exchangeUrl })is enough and an app with a Python or Go backend writes no adapter code at all; overrideexchange()only for a non-standard endpoint. Ships withOAuthCallbackPage— register it on a public route, since the router sends unauthenticated visitors to the login page and the callback arrives before the session exists — and an#alternativesslot onLoginPage, between the form and the footer, which is where users look for SSO buttons. Marked@experimental.