feat(auth): Google OAuth with domain-based access control

.do/app.yaml

@@ -7,6 +7,12 @@ alerts:
 
 ingress:
   rules:
+    # NextAuth OAuth routes → web (must be before /api catch-all)
+    - component:
+        name: web
+      match:
+        path:
+          prefix: /api/auth
     # API endpoints → backend
     - component:
         name: api
@@ -130,3 +136,18 @@ services:
         scope: RUN_TIME
         type: SECRET
         value: REPLACE_WITH_API_KEY
+      - key: GOOGLE_CLIENT_ID
+        scope: RUN_TIME
+        type: SECRET
+        value: REPLACE_WITH_GOOGLE_CLIENT_ID
+      - key: GOOGLE_CLIENT_SECRET
+        scope: RUN_TIME
+        type: SECRET
+        value: REPLACE_WITH_GOOGLE_CLIENT_SECRET
+      - key: AUTH_SECRET
+        scope: RUN_TIME
+        type: SECRET
+        value: REPLACE_WITH_AUTH_SECRET
+      - key: AUTH_URL
+        scope: RUN_TIME
+        value: ${APP_URL}

agent/db/connection.py

@@ -5,6 +5,7 @@
 
 _pool: asyncpg.Pool | None = None
 _pool_lock: asyncio.Lock | None = None
+_users_table_ensured: bool = False
 _DEFAULT_POOL_MIN_SIZE = 2
 _DEFAULT_POOL_MAX_SIZE = 10
 _DEFAULT_POOL_RETRIES = 5
@@ -31,8 +32,28 @@ def _float_env(name: str, default: float, minimum: float = 0.0) -> float:
         return default
 
 
+async def ensure_users_table(pool: asyncpg.Pool) -> None:
+    """Create the users table if it does not already exist (idempotent)."""
+    async with pool.acquire() as conn:
+        await conn.execute(
+            """
+            CREATE TABLE IF NOT EXISTS users (
+                id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
+                email TEXT UNIQUE NOT NULL,
+                name TEXT,
+                image TEXT,
+                approved BOOLEAN NOT NULL DEFAULT FALSE,
+                domain TEXT NOT NULL,
+                created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+                last_login_at TIMESTAMPTZ NOT NULL DEFAULT now()
+            );
+            CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
+            """
+        )
+
+
 async def get_pool() -> asyncpg.Pool:
-    global _pool, _pool_lock
+    global _pool, _pool_lock, _users_table_ensured
     if _pool_lock is None:
         _pool_lock = asyncio.Lock()
     if _pool is not None:
@@ -65,6 +86,16 @@ async def get_pool() -> asyncpg.Pool:
                 await asyncio.sleep(retry_delay * (attempt + 1))
         if _pool is None and last_error is not None:
             raise last_error
+        if _pool is not None and not _users_table_ensured:
+            try:
+                await ensure_users_table(_pool)
+                _users_table_ensured = True
+            except Exception:
+                import logging
+
+                logging.getLogger(__name__).warning(
+                    "Could not create users table — DB may not be ready yet"
+                )
     return _pool
 
 

agent/server.py

@@ -1970,6 +1970,91 @@ async def zero_prompt_build_status(session_id: str, card_id: str):
     }
 
 
+# ── Dashboard Auth ────────────────────────────────────────────────────
+
+
+class UpsertUserRequest(BaseModel):
+    email: str
+    name: str = ""
+    image: str = ""
+
+
+class UpsertUserResponse(BaseModel):
+    id: str
+    email: str
+    name: str
+    approved: bool
+    domain: str
+
+
+class CheckUserResponse(BaseModel):
+    approved: bool
+    domain: str
+    email: str
+
+
+@app.post("/dashboard/auth/upsert-user")
+async def dashboard_auth_upsert_user(body: UpsertUserRequest):
+    from .db.connection import get_pool
+
+    if not body.email or "@" not in body.email:
+        raise HTTPException(status_code=400, detail="invalid_email")
+
+    domain = body.email.rsplit("@", 1)[1].lower()
+    approved = domain == "2weeks.co"
+
+    pool = await get_pool()
+    async with pool.acquire() as conn:
+        row = await conn.fetchrow(
+            """
+            INSERT INTO users (email, name, image, approved, domain)
+            VALUES ($1, $2, $3, $4, $5)
+            ON CONFLICT (email) DO UPDATE
+                SET name = EXCLUDED.name,
+                    image = EXCLUDED.image,
+                    last_login_at = now()
+            RETURNING id, email, name, approved, domain
+            """,
+            body.email,
+            body.name,
+            body.image,
+            approved,
+            domain,
+        )
+
+    return UpsertUserResponse(
+        id=row["id"],
+        email=row["email"],
+        name=row["name"],
+        approved=row["approved"],
+        domain=row["domain"],
+    )
+
+
+@app.get("/dashboard/auth/check-user")
+async def dashboard_auth_check_user(email: str):
+    from .db.connection import get_pool
+
+    if not email or "@" not in email:
+        raise HTTPException(status_code=400, detail="invalid_email")
+
+    pool = await get_pool()
+    async with pool.acquire() as conn:
+        row = await conn.fetchrow(
+            "SELECT approved, domain, email FROM users WHERE email = $1",
+            email,
+        )
+
+    if row is None:
+        raise HTTPException(status_code=404, detail="user_not_found")
+
+    return CheckUserResponse(
+        approved=row["approved"],
+        domain=row["domain"],
+        email=row["email"],
+    )
+
+
 if __name__ == "__main__":
     uvicorn.run(
         "agent.server:app",

web/next.config.ts

@@ -2,6 +2,11 @@ import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
   output: "standalone",
+  images: {
+    remotePatterns: [
+      { protocol: "https", hostname: "lh3.googleusercontent.com" },
+    ],
+  },
 };
 
 export default nextConfig;

web/package.json

@@ -10,6 +10,7 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@auth/core": "^0.41.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -19,6 +20,7 @@
     "framer-motion": "^12.37.0",
     "lucide-react": "^0.577.0",
     "next": "16.1.7",
+    "next-auth": "^5.0.0-beta.30",
     "radix-ui": "^1.4.3",
     "react": "19.2.4",
     "react-dom": "19.2.4",

web/src/app/api/auth/[...nextauth]/route.ts

@@ -0,0 +1,3 @@
+import { handlers } from "@/lib/auth";
+
+export const { GET, POST } = handlers;