# OAuth Environment Inventory (March 19, 2026)

> **Historical evidence:** This inventory records the environment state on
> March 19, 2026. The permanent shared development environment has since been
> retired. Do not use its Vercel, Neon, Fly.io, or OAuth references as current
> setup instructions; follow the current deployment and OAuth runbooks.

## Scope

This inventory covers the Phase 5 provider OAuth separation work for:

- Google.
- OneDrive.
- Dropbox.

It records where provider OAuth credentials are consumed and whether dev/prod are currently separated.

## Current Finding

Provider redirect URIs are already environment-specific, but the actual provider client IDs and client secrets are still shared between dev and prod.

That means Phase 5 is not complete yet.

## Application Consumers

Primary runtime consumers in the Next.js app:

- `src/lib/oauth.ts`.
- `src/lib/service-token-refresh.ts`.
- `src/config/services/google.config.ts`.
- `src/config/services/onedrive.config.ts`.
- `src/config/services/dropbox.config.ts`.

Primary route consumers:

- `src/app/api/google/route.ts`.
- `src/app/api/onedrive/route.ts`.
- `src/app/api/dropbox/route.ts`.
- `src/app/api/auth/refresh/route.ts`.
- provider-specific upload, create-folder, open, and debug routes that call the shared OAuth helpers.

Primary Fly.io surface:

- `fly-rclone/deploy.sh`.
- `fly-rclone/.env.example.template`.

## Vercel Inventory

Production env variable slots exist for:

- `GOOGLE_CLIENT_ID`.
- `GOOGLE_CLIENT_SECRET`.
- `GOOGLE_REDIRECT_URI`.
- `ONEDRIVE_CLIENT_ID`.
- `ONEDRIVE_CLIENT_SECRET`.
- `ONEDRIVE_REDIRECT_URI`.
- `DROPBOX_CLIENT_ID`.
- `DROPBOX_CLIENT_SECRET`.
- `DROPBOX_REDIRECT_URI`.

Dev and prod comparison from pulled Vercel env files:

- Google client ID: same.
- Google client secret: same.
- Google redirect URI: different.
- OneDrive client ID: same.
- OneDrive client secret: same.
- OneDrive redirect URI: different.
- Dropbox client ID: same.
- Dropbox client secret: same.
- Dropbox redirect URI: different.

Meaning:

- The app/project wiring is already in place.
- The actual provider apps are still shared between dev and prod.

## Fly.io Inventory

Both Fly apps have provider secret slots populated:

- `stratofusion-rclone-dev`.
- `stratofusion-rclone-prod`.

Secret-name comparison showed identical deployed digests for:

- `GOOGLE_CLIENT_ID`.
- `GOOGLE_CLIENT_SECRET`.
- `ONEDRIVE_CLIENT_ID`.
- `ONEDRIVE_CLIENT_SECRET`.
- `DROPBOX_CLIENT_ID`.
- `DROPBOX_CLIENT_SECRET`.

Meaning:

- Fly dev and Fly prod are also still sharing provider credentials.

Current implementation detail:

- The Fly service does not currently read `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`, `ONEDRIVE_CLIENT_ID`, `ONEDRIVE_CLIENT_SECRET`, `DROPBOX_CLIENT_ID`, or `DROPBOX_CLIENT_SECRET` directly in its request path.
- The Next.js app generates the rclone config using `src/lib/rclone/core/config-templates.ts` and sends that config to Fly per request.
- So the main app envs are the primary runtime source today, and the Fly secrets are currently environment-parity/config-surface inventory rather than the main execution dependency.

## Local Inventory

No local `.env.local`, `.env`, or `.env.development.local` file exists in the clean Phase 5 worktree, so local provider values were not inventoried from disk.

Local still needs its own provider apps and credentials configured separately from dev and prod.

## External Work Still Required

Create separate provider apps for:

- local.
- dev.
- prod.

Then update:

- local `.env.local`.
- Vercel project `stratofusion-dev`.
- Vercel project `stratofusion-prod`.
- Fly app `stratofusion-rclone-dev`.
- Fly app `stratofusion-rclone-prod`.

## Recommended Follow-Up

1. Create new Google, OneDrive, and Dropbox apps for local/dev/prod.
2. Replace shared dev/prod provider credentials in Vercel.
3. Replace shared dev/prod provider credentials in Fly.
4. Test provider auth flows independently in local, dev, and prod.

Detailed runbook:

- `public/docs/OAUTH_PROVIDER_UPDATE_RUNBOOK_2026-03-19.md`.