Share Google OAuth core and HTTPS broker callbacks

[mohammedahmed18]

Summary

• Share Google hosted OAuth connector IDs, callback paths, authorization URL contracts, and exact scope validation in locality-auth-core.
• Keep local OAuth production-safe by sending providers to the HTTPS OAuth broker first, then relaying back to localhost.
• Harden malformed redirect/scope handling for Google Docs, Calendar, and Gmail.

Test Plan

• cargo test -p locality-auth-core --locked
• cargo test -p locality-connector oauth_broker --locked
• npm --prefix apps/oauth-service test -- app.test.ts google-calendar.test.ts
• cargo fmt --check
• git diff --check origin/codex/shared-oauth-core-and-https-broker-callback..HEAD

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Aug 6, 2026 6:25pm