feat(auth): implement Google OAuth login flow and handle session clearing on 401

src/app/core/services/auth/auth.service.spec.ts

@@ -96,7 +96,7 @@ describe('AuthService', () => {
     httpController.verify();
   });
 
-  it('propagates a 401 from /me without clearing the session', async () => {
+  it('clears an expired session when /me returns 401', async () => {
     cookieStore['shopit.auth.token'] = 'expired-token';
 
     TestBed.configureTestingModule({
@@ -117,11 +117,11 @@ describe('AuthService', () => {
 
     request.flush({ message: 'Unauthorized' }, { status: 401, statusText: 'Unauthorized' });
 
-    await expect(bootstrapPromise).rejects.toMatchObject({ status: 401 });
+    await expect(bootstrapPromise).resolves.toBeUndefined();
     expect(service.user()).toBeNull();
-    expect(service.token()).toBe('expired-token');
-    expect(service.isAuthenticated()).toBe(true);
-    expect(cookieStore['shopit.auth.token']).toBe('expired-token');
+    expect(service.token()).toBeNull();
+    expect(service.isAuthenticated()).toBe(false);
+    expect(cookieStore['shopit.auth.token']).toBeUndefined();
 
     httpController.verify();
   });

src/app/core/services/auth/auth.service.ts

@@ -1,4 +1,5 @@
-import { HttpClient } from '@angular/common/http';
+import { DOCUMENT } from '@angular/common';
+import { HttpClient, HttpErrorResponse } from '@angular/common/http';
 import { isPlatformBrowser, isPlatformServer } from '@angular/common';
 import { computed, inject, Injectable, PLATFORM_ID, signal, TransferState, makeStateKey } from '@angular/core';
 import { firstValueFrom, map, Observable, of, tap } from 'rxjs';
@@ -23,6 +24,7 @@ const AUTH_USER_SSR_STATE_KEY = makeStateKey<AuthUser>('shopit.auth.user');
 })
 export class AuthService {
   private readonly http = inject(HttpClient);
+  private readonly document = inject(DOCUMENT);
   private readonly platformId = inject(PLATFORM_ID);
   private readonly cookieService = inject(CookieService);
   private readonly transferState = inject(TransferState);
@@ -51,6 +53,27 @@ export class AuthService {
     });
   }
 
+  loginWithGoogle(): void {
+    const tenant = this.tenantService.getTenant();
+    if (!tenant) {
+      throw new Error('No se pudo resolver el tenant activo.');
+    }
+
+    const apiUrl = new URL(environment.url);
+    const authorizationUrl = new URL('/auth/google/redirect', apiUrl.origin);
+    authorizationUrl.searchParams.set('tenant', tenant.codigo);
+    authorizationUrl.searchParams.set('return_url', this.document.location.origin);
+
+    this.document.location.assign(authorizationUrl.toString());
+  }
+
+  completeGoogleLogin(oauthCode: string): Observable<AuthUser> {
+    return this.http.post<LoginResponse>(`${environment.url}auth/google/exchange`, { oauth_code: oauthCode }).pipe(
+      tap((response) => this.applyAuthenticatedState(response.token, response.user)),
+      map((response) => response.user)
+    );
+  }
+
   updateProfile(payload: UpdateProfilePayload): Observable<AuthUser> {
     return this.http.put<AuthUser>(`${environment.url}me`, payload).pipe(
       tap((user) => this.userState.set(user))
@@ -82,9 +105,24 @@ export class AuthService {
       return;
     }
 
-    const user = await firstValueFrom(this.loadCurrentUser());
-    if (isPlatformServer(this.platformId)) {
-      this.transferState.set(AUTH_USER_SSR_STATE_KEY, user);
+    try {
+      const user = await firstValueFrom(this.loadCurrentUser());
+
+      if (isPlatformServer(this.platformId)) {
+        this.transferState.set(AUTH_USER_SSR_STATE_KEY, user);
+      }
+    } catch (error) {
+      // An expired token is an expected state, including while rendering on the
+      // server. Do not let it reject the application initializer: Angular's SSR
+      // pipeline can otherwise attempt to serialize HttpErrorResponse internals
+      // as HTTP headers.
+      if (error instanceof HttpErrorResponse && error.status === 401) {
+        this.clearSession();
+
+        return;
+      }
+
+      throw error;
     }
   }