OAuth 2.0 Implementation

# OAuth 2.0 Implementation for Google Antigravity

Master OAuth 2.0 authentication flows in Google Antigravity IDE. This guide covers authorization code flow, PKCE, and token management.

## Authorization Code Flow

```typescript
import { OAuth2Client } from "google-auth-library";

const client = new OAuth2Client(
  process.env.GOOGLE_CLIENT_ID,
  process.env.GOOGLE_CLIENT_SECRET,
  process.env.GOOGLE_REDIRECT_URI
);

export function getAuthUrl(state: string) {
  return client.generateAuthUrl({
    access_type: "offline",
    scope: ["openid", "email", "profile"],
    state,
    prompt: "consent"
  });
}

export async function exchangeCode(code: string) {
  const { tokens } = await client.getToken(code);
  client.setCredentials(tokens);
  
  const ticket = await client.verifyIdToken({
    idToken: tokens.id_token!,
    audience: process.env.GOOGLE_CLIENT_ID
  });
  
  return ticket.getPayload();
}
```

## PKCE Implementation

```typescript
import crypto from "crypto";

function generateCodeVerifier(): string {
  return crypto.randomBytes(32).toString("base64url");
}

function generateCodeChallenge(verifier: string): string {
  return crypto.createHash("sha256").update(verifier).digest("base64url");
}

export async function startPKCEFlow() {
  const codeVerifier = generateCodeVerifier();
  const codeChallenge = generateCodeChallenge(codeVerifier);
  const state = crypto.randomBytes(16).toString("hex");
  
  await redis.set(`pkce:${state}`, codeVerifier, { EX: 600 });
  
  return { codeChallenge, state };
}
```

## Best Practices

1. **Use PKCE** - Even for server apps
2. **Validate state** - Prevent CSRF
3. **Store tokens securely** - Encrypt at rest

Google Antigravity IDE provides OAuth scaffolding.