Fix the Pages deploy step, and trim Google OAuth credentials

.github/workflows/deploy-cloudflare.yml

@@ -86,11 +86,16 @@ jobs:
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          # --functions-directory is explicit: the proxy in functions/ lives at
-          # the repo root, not inside dist/, and losing it would deploy a
-          # frontend that quietly falls back to the free tier.
+          # Pinned to the backend's wrangler. Left unset, the action installs
+          # its own default (3.90.0 at the time of writing), which is a major
+          # version behind and rejected the flags this step used to pass.
+          wranglerVersion: '4.134.0'
+          # No --functions-directory: wrangler has no such flag. `pages deploy`
+          # compiles ./functions from the working directory, which is the repo
+          # root here — the proxy lives there, not inside dist/, and deploying
+          # without it would serve a frontend that quietly falls back to the
+          # free tier.
           command: >-
             pages deploy dist
             --project-name=bottlecount
             --branch=main
-            --functions-directory=functions

backend/src/routes/auth.ts

@@ -15,15 +15,21 @@ type Bindings = {
 const auth = new Hono<{ Bindings: Bindings; Variables: AppVariables }>();
 
 auth.use('/google', async (c, next) => {
-  if (!c.env.GOOGLE_CLIENT_ID) {
+  // Trimmed because these are pasted into `wrangler secret put` by hand, and a
+  // trailing newline or carriage return — easy to pick up from a terminal —
+  // makes Google reject the secret as invalid with nothing visibly wrong.
+  // Neither value can legitimately contain whitespace.
+  const clientId = c.env.GOOGLE_CLIENT_ID?.trim();
+  const clientSecret = c.env.GOOGLE_CLIENT_SECRET?.trim();
+  if (!clientId) {
     return c.json({ error: 'Missing GOOGLE_CLIENT_ID' }, 500);
   }
-  if (!c.env.GOOGLE_CLIENT_SECRET) {
+  if (!clientSecret) {
     return c.json({ error: 'Missing GOOGLE_CLIENT_SECRET' }, 500);
   }
   const handler = googleAuth({
-    client_id: c.env.GOOGLE_CLIENT_ID,
-    client_secret: c.env.GOOGLE_CLIENT_SECRET,
+    client_id: clientId,
+    client_secret: clientSecret,
     scope: ['openid', 'email', 'profile'],
     // The redirect target is the *frontend* origin: the Pages Function at
     // functions/auth/google.ts proxies it straight back here, which is what