From 5b21aaacee631dc4906e76d77a1e0e4f432cc767 Mon Sep 17 00:00:00 2001
From: rudrabjoshi <rudraj2022@gmail.com>
Date: Wed, 19 Aug 2026 20:19:31 -0700
Subject: [PATCH 1/3] Add OAuth + student ID verified password reset flow

New /support page: a topic list (currently just "Password Reset") that
deep-links via ?topic=reset straight into a "Let's Reset Your Password"
wizard, skipping the topic list -- used by "Forgot your password?" links
elsewhere so /support can grow to cover more than password reset later
without adding friction. The wizard animates through GitHub ID entry ->
school Google OAuth sign-in -> new password, calling the new Spring
OAuth-verified reset endpoints (/mvc/person/reset/oauth/verify,
/mvc/person/reset/oauth/complete). The Google ID token is only relayed
raw to the backend; the digit-match/identity check happens server-side,
not in this client code.

login.md: "Forgot your password?" now links to /support?topic=reset
instead of an embedded reset panel on the login page itself.

profile.html: removed the old "New Password" field, which let a logged-in
user overwrite their password with zero verification (no current-password
check, no reset token). Replaced with a "Forgot your password?" link into
the same verified reset flow. Cleaned up saveChanges()'s now-dead
password-save branch and the logout alert text that referenced it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 _layouts/profile.html                |  31 +--
 navigation/authentication/login.md   |   3 +
 navigation/authentication/support.md | 329 +++++++++++++++++++++++++++
 3 files changed, 335 insertions(+), 28 deletions(-)
 create mode 100644 navigation/authentication/support.md

diff --git a/_layouts/profile.html b/_layouts/profile.html
index b19f08810..49cb09a16 100644
--- a/_layouts/profile.html
+++ b/_layouts/profile.html
@@ -58,11 +58,8 @@ <h2 class="text-xl font-semibold mb-6">Personal Information</h2>
 
             <!-- Password Change -->
             <div>
-                <label for="password" class="block text-sm font-medium text-gray-300 mb-1">New
-                    Password</label>
-                <input type="password" id="password" name="password"
-                    class="w-full px-4 py-2 rounded-lg border border-gray-600 bg-neutral-700 focus:outline-none focus:ring-2 focus:ring-indigo-500"
-                    placeholder="Enter new password" onchange="checkForChanges()" autocomplete="new-password">
+                <label class="block text-sm font-medium text-gray-300 mb-1">Password</label>
+                <a href="{{ site.baseurl }}/support?topic=reset" class="text-sm text-indigo-400 hover:text-indigo-300 inline-block">Forgot your password?</a>
             </div>
         </div>
     </div>
@@ -1317,7 +1314,6 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
         const uidInput = document.getElementById("uidChangeInput");
         const emailInput = document.getElementById("emailChangeInput");
         const sidInput = document.getElementById("sidChangeInput");
-        const passwordInput = document.getElementById("password");
         const kasmInput = document.getElementById("kasmChangeInput");
         const schoolInput = document.getElementById("schoolChangeInput");
 
@@ -1326,7 +1322,6 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
         const uid = uidInput.value.trim();
         const email = emailInput.value.trim();
         const sid = sidInput.value.trim();
-        const password = passwordInput.value.trim();
         const kasmServerNeeded = kasmInput ? kasmInput.checked : undefined;
         const school = schoolInput.value;
 
@@ -1422,26 +1417,6 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
             }
         }
 
-        // save password (both backends, logs out)
-        if (password) {
-            try {
-                await Promise.all([
-                    putUpdate({
-                        URL: pythonURI + "/api/user",
-                        body: { password },
-                        message: 'password-message'
-                    }),
-                    postUpdate({
-                        URL: javaURI + "/api/person/update",
-                        body: { password }
-                    })
-                ]);
-                needsLogout = true;
-            } catch (e) {
-                console.error("error saving password:", e.message);
-            }
-        }
-
         // save kasm server status (both backends)
         if (
             typeof kasmServerNeeded !== "undefined" &&
@@ -1511,7 +1486,7 @@ <h4 class="text-red-400 font-semibold mb-1">Selection Failed</h4>
 
         // handle reload or logout if needed
         if (needsLogout) {
-            alert("you updated your github id or password, so you will be logged out. remember your new credentials!");
+            alert("you updated your github id, so you will be logged out. remember your new credentials!");
             window.location.href = '{{site.baseurl}}';
         } else if (needsReload) {
             window.location.reload();
diff --git a/navigation/authentication/login.md b/navigation/authentication/login.md
index 296da6aed..8ecbd8130 100644
--- a/navigation/authentication/login.md
+++ b/navigation/authentication/login.md
@@ -25,6 +25,9 @@ show_reading_time: false
                 <button type="submit" class="large primary submit-button">Login</button>
             </p>
             <p id="message" style="color: red;"></p>
+            <p style="text-align: center;">
+                <a href="{{site.baseurl}}/support?topic=reset">Forgot your password?</a>
+            </p>
         </form>
     </div>
     <div class="signup-card">
diff --git a/navigation/authentication/support.md b/navigation/authentication/support.md
new file mode 100644
index 000000000..e6732cdb0
--- /dev/null
+++ b/navigation/authentication/support.md
@@ -0,0 +1,329 @@
+---
+layout: page
+title: Support
+permalink: /support
+search_exclude: true
+show_reading_time: false
+---
+<br>
+
+<script src="https://accounts.google.com/gsi/client" async defer></script>
+
+<style>
+    .support-topic-list {
+        list-style: none;
+        padding: 0;
+        margin: 0;
+        display: flex;
+        flex-direction: column;
+        gap: 0.6rem;
+    }
+    .support-topic-item {
+        padding: 1rem 1.25rem;
+        cursor: pointer;
+        border: 1px solid rgba(255, 255, 255, 0.15);
+        background-color: rgba(255, 255, 255, 0.04);
+        border-radius: 6px;
+        transition: background-color 0.2s ease, border-color 0.2s ease;
+    }
+    .support-topic-item:hover {
+        background-color: rgba(255, 255, 255, 0.09);
+        border-color: rgba(255, 255, 255, 0.3);
+    }
+
+    .support-back-row {
+        display: flex;
+        justify-content: flex-end;
+        margin-top: 2rem;
+    }
+
+    #support-reset-wizard {
+        display: none;
+        width: 100%;
+        min-height: 100vh;
+        box-sizing: border-box;
+        padding: 3rem 1.5rem;
+        justify-content: center;
+    }
+    #support-reset-wizard.active {
+        display: flex;
+        animation: supportFadeIn 0.4s ease;
+    }
+    .support-wizard-inner {
+        width: 100%;
+        max-width: 480px;
+    }
+
+    .support-step { display: none; opacity: 0; }
+    .support-step.active { display: block; animation: supportStepIn 0.4s ease forwards; }
+    .support-step.leaving { display: block; animation: supportStepOut 0.25s ease forwards; }
+
+    @keyframes supportFadeIn {
+        from { opacity: 0; transform: translateY(8px); }
+        to { opacity: 1; transform: translateY(0); }
+    }
+    @keyframes supportStepIn {
+        from { opacity: 0; transform: translateY(16px); }
+        to { opacity: 1; transform: translateY(0); }
+    }
+    @keyframes supportStepOut {
+        from { opacity: 1; transform: translateY(0); }
+        to { opacity: 0; transform: translateY(-16px); }
+    }
+</style>
+
+<!-- Landing view: list of support topics -->
+<div id="support-topics-container" style="max-width: 700px; margin: 0 auto; padding: 0 1.5rem;">
+    <ul class="support-topic-list">
+        <li class="support-topic-item" onclick="openSupportTopic('reset')">Password Reset</li>
+    </ul>
+    <div class="support-back-row">
+        <a href="{{site.baseurl}}/login">← Back to Login</a>
+    </div>
+</div>
+
+<!-- OAuth + Student ID Verified Password Reset: takes over the full page when opened -->
+<div id="support-reset-wizard">
+    <div class="support-wizard-inner">
+        <h1>Let's Reset Your Password</h1>
+        <hr>
+        <div id="reset-step-uid" class="support-step active">
+            <div class="form-group">
+                <input type="text" id="resetUid" placeholder="GitHub ID" required>
+            </div>
+            <p>
+                <button type="button" class="large primary submit-button" onclick="startOAuthReset()">Verify with School Account</button>
+            </p>
+        </div>
+        <div id="reset-step-oauth" class="support-step" style="text-align: center; margin-bottom: 1.5rem;">
+            <p style="margin-bottom: 1rem; color: #d1d5db;">
+                Sign in with your <strong>@stu.powayusd.com</strong> school Google account to verify it's you.
+            </p>
+            <div id="reset-g_id_signin_container" style="display: flex; justify-content: center; margin-bottom: 1rem;"></div>
+            <div id="reset-oauth-status" style="margin-top: 1rem;"></div>
+        </div>
+        <div id="reset-step-password" class="support-step">
+            <div class="form-group">
+                <input type="password" id="resetNewPassword" placeholder="New Password" required>
+            </div>
+            <div class="form-group">
+                <input type="password" id="resetConfirmPassword" placeholder="Confirm New Password" required>
+            </div>
+            <p id="reset-password-validation-message"></p>
+            <p>
+                <button type="button" class="large primary submit-button" onclick="submitOAuthResetPassword()">Set New Password</button>
+            </p>
+        </div>
+        <p id="reset-message" style="color: red;"></p>
+        <div class="support-back-row">
+            <a href="#" onclick="backToSupportTopics(); return false;">← Back</a>
+        </div>
+    </div>
+</div>
+
+<script type="module">
+    import { javaURI, fetchOptions } from '{{site.baseurl}}/assets/js/api/config.js';
+
+    const GOOGLE_CLIENT_ID = "65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com";
+
+    // ---- Support topic navigation ----
+    window.openSupportTopic = function(topic) {
+        if (topic !== 'reset') return;
+        document.getElementById('support-topics-container').style.display = 'none';
+        document.getElementById('support-reset-wizard').classList.add('active');
+    }
+
+    window.backToSupportTopics = function() {
+        document.getElementById('support-reset-wizard').classList.remove('active');
+        document.getElementById('support-topics-container').style.display = '';
+        resetWizardState();
+    }
+
+    function resetWizardState() {
+        resetUidValue = null;
+        resetTokenValue = null;
+        document.getElementById('resetUid').value = '';
+        document.getElementById('resetNewPassword').value = '';
+        document.getElementById('resetConfirmPassword').value = '';
+        document.getElementById('reset-message').textContent = '';
+        document.getElementById('reset-oauth-status').innerHTML = '';
+        goToResetStep('reset-step-uid');
+    }
+
+    // Animates between the reset wizard's steps: the outgoing step fades/slides out,
+    // then the incoming step fades/slides in (see supportStepIn/Out keyframes above).
+    function goToResetStep(stepId) {
+        document.querySelectorAll('.support-step').forEach(step => {
+            if (step.id === stepId) {
+                step.classList.remove('leaving');
+                step.classList.add('active');
+            } else if (step.classList.contains('active')) {
+                step.classList.remove('active');
+                step.classList.add('leaving');
+                setTimeout(() => step.classList.remove('leaving'), 300);
+            }
+        });
+    }
+
+    // ---- OAuth + Student ID Verified Password Reset ----
+    // The digit-match check is re-verified server-side against a server-verified Google ID
+    // token (see /mvc/person/reset/oauth/verify) — this client code only relays the raw
+    // credential and renders the UI states the backend tells it about.
+    let resetUidValue = null;
+    let resetTokenValue = null;
+
+    function showResetOAuthStatus(message, isError = false) {
+        const statusDiv = document.getElementById('reset-oauth-status');
+        statusDiv.innerHTML = `<div class="${isError ? 'oauth-error' : 'oauth-success'}">${message}</div>`;
+    }
+
+    window.startOAuthReset = function() {
+        const uid = document.getElementById('resetUid').value.trim();
+        if (!uid) {
+            document.getElementById('reset-message').textContent = 'Please enter your GitHub ID.';
+            return;
+        }
+        resetUidValue = uid;
+        document.getElementById('reset-message').textContent = '';
+
+        goToResetStep('reset-step-oauth');
+
+        if (window.google && window.google.accounts) {
+            window.google.accounts.id.initialize({
+                client_id: GOOGLE_CLIENT_ID,
+                callback: handleGoogleResetSignIn
+            });
+            window.google.accounts.id.renderButton(
+                document.getElementById('reset-g_id_signin_container'),
+                { type: 'standard', size: 'large', theme: 'filled_blue', text: 'signin_with', shape: 'rectangular' }
+            );
+        }
+    }
+
+    window.handleGoogleResetSignIn = function(response) {
+        showResetOAuthStatus('Verifying your school account...');
+
+        fetch(`${javaURI}/mvc/person/reset/oauth/verify`, {
+            ...fetchOptions,
+            method: 'POST',
+            body: JSON.stringify({ uid: resetUidValue, idToken: response.credential }),
+        })
+        .then(res => {
+            if (res.status === 429) {
+                showResetOAuthStatus('❌ Too many reset attempts. Please try again later.', true);
+                return null;
+            }
+            if (!res.ok) {
+                showResetOAuthStatus('❌ We could not verify that this school account belongs to this user. Please check your GitHub ID and try again with your own school account.', true);
+                return null;
+            }
+            return res.json();
+        })
+        .then(data => {
+            if (!data || !data.verified) return;
+            resetTokenValue = data.resetToken;
+            showResetOAuthStatus('✅ School account verified!');
+            setTimeout(() => {
+                goToResetStep('reset-step-password');
+            }, 1000);
+        })
+        .catch(error => {
+            console.error('Reset verification failed:', error);
+            showResetOAuthStatus('❌ Something went wrong verifying your account. Please try again.', true);
+        });
+    }
+
+    function validateResetForm() {
+        const password = document.getElementById('resetNewPassword').value;
+        const confirmPassword = document.getElementById('resetConfirmPassword').value;
+        const confirmField = document.getElementById('resetConfirmPassword');
+        const messageDiv = document.getElementById('reset-password-validation-message');
+
+        confirmField.classList.remove('password-match', 'password-mismatch', 'password-length');
+        messageDiv.classList.remove('success', 'error');
+
+        if (confirmPassword === '') {
+            messageDiv.textContent = '';
+            return true;
+        }
+
+        if (password.length < 8) {
+            confirmField.classList.add('password-length');
+            messageDiv.classList.add('error');
+            messageDiv.textContent = '✗ Passwords must be at least 8 characters long';
+            return false;
+        }
+
+        if (password === confirmPassword) {
+            confirmField.classList.add('password-match');
+            messageDiv.classList.add('success');
+            messageDiv.textContent = '✓ Passwords match';
+            return true;
+        } else {
+            confirmField.classList.add('password-mismatch');
+            messageDiv.classList.add('error');
+            messageDiv.textContent = '✗ Passwords do not match';
+            return false;
+        }
+    }
+
+    window.submitOAuthResetPassword = function() {
+        const password = document.getElementById('resetNewPassword').value;
+        const confirmPassword = document.getElementById('resetConfirmPassword').value;
+
+        if (password.length < 8) {
+            alert('Password must be at least 8 characters long.');
+            return;
+        }
+        if (password !== confirmPassword) {
+            alert('Passwords do not match. Please try again.');
+            return;
+        }
+        if (!resetUidValue || !resetTokenValue) {
+            document.getElementById('reset-message').style.color = 'red';
+            document.getElementById('reset-message').textContent = 'Your verification expired. Please start over.';
+            return;
+        }
+
+        fetch(`${javaURI}/mvc/person/reset/oauth/complete`, {
+            ...fetchOptions,
+            method: 'POST',
+            body: JSON.stringify({ uid: resetUidValue, resetToken: resetTokenValue, newPassword: password }),
+        })
+        .then(res => {
+            if (!res.ok) {
+                throw new Error('reset-failed');
+            }
+            document.getElementById('reset-message').style.color = 'green';
+            document.getElementById('reset-message').textContent = '✅ Password updated! Redirecting to login...';
+            resetUidValue = null;
+            resetTokenValue = null;
+            setTimeout(() => {
+                window.location.href = '{{site.baseurl}}/login';
+            }, 1500);
+        })
+        .catch(error => {
+            console.error('Reset completion failed:', error);
+            document.getElementById('reset-message').style.color = 'red';
+            document.getElementById('reset-message').textContent = 'Could not update your password. Your verification may have expired — please start over.';
+        });
+    }
+
+    window.addEventListener('load', function() {
+        const resetPasswordField = document.getElementById('resetNewPassword');
+        const resetConfirmPasswordField = document.getElementById('resetConfirmPassword');
+        if (resetPasswordField && resetConfirmPasswordField) {
+            resetPasswordField.addEventListener('input', validateResetForm);
+            resetConfirmPasswordField.addEventListener('input', validateResetForm);
+        }
+
+        // Deep-link support: ?topic=reset skips the topic list and jumps straight
+        // into the password reset wizard (used by the "Forgot your password?" link
+        // elsewhere on the site, so it doesn't force an extra click once /support
+        // grows to cover more than just password reset).
+        const params = new URLSearchParams(window.location.search);
+        if (params.get('topic') === 'reset') {
+            openSupportTopic('reset');
+        }
+    });
+</script>

From 879d341f00217b4f5cf56e56492dd64e83850bb2 Mon Sep 17 00:00:00 2001
From: rudrabjoshi <rudraj2022@gmail.com>
Date: Thu, 20 Aug 2026 10:32:01 -0700
Subject: [PATCH 2/3] Add rate-limit reset ticket button and fix minor
 reset-flow UI gaps

Adds a "Request a Ticket Instead" button to the OAuth password-reset wizard,
shown when the reset rate limit is hit; it posts to Spring's new
/mvc/person/reset/ticket endpoint so an admin can grant more attempts.

Also: styles the .password-length validation class (was referenced but never
defined), and de-dupes the Google OAuth client_id into a single
GOOGLE_CLIENT_ID export in config.js instead of separate copies in login.md
and support.md.
---
 .../elements/forms/passwordvalidation.scss    |  5 +++
 assets/js/api/config.js                       |  4 ++
 navigation/authentication/login.md            |  3 +-
 navigation/authentication/support.md          | 37 +++++++++++++++++--
 4 files changed, 43 insertions(+), 6 deletions(-)

diff --git a/_sass/open-coding/elements/forms/passwordvalidation.scss b/_sass/open-coding/elements/forms/passwordvalidation.scss
index b2c6ced62..a0d015c26 100644
--- a/_sass/open-coding/elements/forms/passwordvalidation.scss
+++ b/_sass/open-coding/elements/forms/passwordvalidation.scss
@@ -19,6 +19,11 @@ $validation-focus-color: #6366f1 !default;
     box-shadow: 0 0 0 1px $validation-error-color !important;
 }
 
+.password-length {
+    border-color: $validation-error-color !important;
+    box-shadow: 0 0 0 1px $validation-error-color !important;
+}
+
 // Validation message styling
 .validation-message {
     font-size: 0.8rem;
diff --git a/assets/js/api/config.js b/assets/js/api/config.js
index c5394b874..461376c64 100644
--- a/assets/js/api/config.js
+++ b/assets/js/api/config.js
@@ -21,6 +21,10 @@ if (location.hostname === "localhost" || location.hostname === "127.0.0.1") {
     javaURI = "https://spring.opencodingsociety.com";
 }
 
+// Shared across the signup, login, and password-reset OAuth flows (login.md,
+// support.md) so the client_id only needs updating in one place.
+export const GOOGLE_CLIENT_ID = "65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com";
+
 export var javaWebSocketURI;
 if (location.hostname === "localhost" || location.hostname === "127.0.0.1") {
     javaWebSocketURI = "http://localhost:8589";
diff --git a/navigation/authentication/login.md b/navigation/authentication/login.md
index 8ecbd8130..a4e76c59c 100644
--- a/navigation/authentication/login.md
+++ b/navigation/authentication/login.md
@@ -123,12 +123,11 @@ show_reading_time: false
 </div>
 
 <script type="module">
-    import { login, pythonURI, javaURI, fetchOptions } from '{{site.baseurl}}/assets/js/api/config.js';
+    import { login, pythonURI, javaURI, fetchOptions, GOOGLE_CLIENT_ID } from '{{site.baseurl}}/assets/js/api/config.js';
 
     let signupFormData = {};
     let verifiedSchoolEmail = null;
     let validationTimeout = null;
-    const GOOGLE_CLIENT_ID = "65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com";
 
     // Password validation with debouncing (1.5 second delay)
     function validatePasswordsDebounced() {
diff --git a/navigation/authentication/support.md b/navigation/authentication/support.md
index e6732cdb0..04b374c88 100644
--- a/navigation/authentication/support.md
+++ b/navigation/authentication/support.md
@@ -101,6 +101,9 @@ show_reading_time: false
             </p>
             <div id="reset-g_id_signin_container" style="display: flex; justify-content: center; margin-bottom: 1rem;"></div>
             <div id="reset-oauth-status" style="margin-top: 1rem;"></div>
+            <p id="reset-ticket-row" style="display: none; margin-top: 1rem;">
+                <button type="button" class="large secondary submit-button" onclick="requestResetTicket(this)">Request a Ticket Instead</button>
+            </p>
         </div>
         <div id="reset-step-password" class="support-step">
             <div class="form-group">
@@ -122,9 +125,7 @@ show_reading_time: false
 </div>
 
 <script type="module">
-    import { javaURI, fetchOptions } from '{{site.baseurl}}/assets/js/api/config.js';
-
-    const GOOGLE_CLIENT_ID = "65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com";
+    import { javaURI, fetchOptions, GOOGLE_CLIENT_ID } from '{{site.baseurl}}/assets/js/api/config.js';
 
     // ---- Support topic navigation ----
     window.openSupportTopic = function(topic) {
@@ -147,6 +148,7 @@ show_reading_time: false
         document.getElementById('resetConfirmPassword').value = '';
         document.getElementById('reset-message').textContent = '';
         document.getElementById('reset-oauth-status').innerHTML = '';
+        document.getElementById('reset-ticket-row').style.display = 'none';
         goToResetStep('reset-step-uid');
     }
 
@@ -210,7 +212,8 @@ show_reading_time: false
         })
         .then(res => {
             if (res.status === 429) {
-                showResetOAuthStatus('❌ Too many reset attempts. Please try again later.', true);
+                showResetOAuthStatus('❌ Too many reset attempts. Please try again later, or request a ticket below.', true);
+                document.getElementById('reset-ticket-row').style.display = 'block';
                 return null;
             }
             if (!res.ok) {
@@ -233,6 +236,32 @@ show_reading_time: false
         });
     }
 
+    // Fires when a rate-limited user asks for admin help instead of waiting out the
+    // window. Creates (or reuses, if one's already open) a ResetTicket for this uid; an
+    // admin resolves it from the Spring person/read portal, granting a batch of 5 extra
+    // attempts. Doesn't require the OAuth step to have succeeded, since the whole point
+    // is to cover the case where the user can't get through it right now.
+    window.requestResetTicket = function(btn) {
+        if (!resetUidValue) return;
+        btn.disabled = true;
+
+        fetch(`${javaURI}/mvc/person/reset/ticket`, {
+            ...fetchOptions,
+            method: 'POST',
+            body: JSON.stringify({ uid: resetUidValue }),
+        })
+        .then(res => {
+            if (!res.ok) throw new Error('ticket-failed');
+            showResetOAuthStatus('✅ Ticket submitted! An admin will grant you more attempts soon.');
+            btn.style.display = 'none';
+        })
+        .catch(error => {
+            console.error('Reset ticket request failed:', error);
+            showResetOAuthStatus('❌ Could not submit a ticket. Please try again.', true);
+            btn.disabled = false;
+        });
+    }
+
     function validateResetForm() {
         const password = document.getElementById('resetNewPassword').value;
         const confirmPassword = document.getElementById('resetConfirmPassword').value;

From b2b731e2ab96619e769cc3a3f94c8e4c8c0cab3d Mon Sep 17 00:00:00 2001
From: rudrabjoshi <rudraj2022@gmail.com>
Date: Thu, 3 Sep 2026 20:21:52 -0700
Subject: [PATCH 3/3] Stop committing the Google OAuth client id to the repo

John Mortensen's review on PR #1371:
- "This does not look like something we should publish in GitHub:
  65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com
  We should have a UI and workflow review prior to pull."
- "These techniques are not allowed in production systems. You need a
  .env that contains keys."

The client id was hardcoded in two places -- assets/js/api/config.js's
GOOGLE_CLIENT_ID and login.md's data-client_id -- both now read
{{ site.google_client_id }} via Liquid instead, one source of truth
between the two.

_config.yml itself no longer sets google_client_id at all -- that's the
actual fix John is asking for, not just deduplicating the literal. It's
injected at build time into a gitignored override config instead:

- Locally: new scripts/generate_local_config_override.sh reads .env (see
  the new .env.example) and writes _config.local.yml -- the file
  Makefile's jekyll-serve already referenced in a comment as supported but
  never actually wired up. jekyll-serve now runs the script and passes
  --config _config.yml,_config.local.yml.
- In CI: the existing "Compute and apply baseurl" step in
  .github/workflows/jekyll-gh-pages.yml now also writes google_client_id
  into _config.override.yml (the same file it already generates for
  baseurl), sourced from a GOOGLE_CLIENT_ID repository secret.

That secret doesn't exist yet -- needs a repo admin to add it in
Settings > Secrets and variables > Actions before the deployed site's
Google sign-in button will render; the build itself succeeds either way.

Verified locally: generated _config.local.yml from a real .env, rebuilt
Jekyll with the merged config, confirmed both config.js's GOOGLE_CLIENT_ID
and login.md's data-client_id still resolve to the real value at runtime,
and confirmed the literal id string no longer appears anywhere in tracked
source (_config.yml, config.js, or navigation/authentication/*.md).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .env.example                              |  8 +++++++
 .github/workflows/jekyll-gh-pages.yml     | 10 ++++++++
 Makefile                                  |  6 +++--
 _config.yml                               | 11 ++++++++-
 assets/js/api/config.js                   |  2 +-
 navigation/authentication/login.md        |  2 +-
 scripts/generate_local_config_override.sh | 29 +++++++++++++++++++++++
 7 files changed, 63 insertions(+), 5 deletions(-)
 create mode 100644 .env.example
 create mode 100755 scripts/generate_local_config_override.sh

diff --git a/.env.example b/.env.example
new file mode 100644
index 000000000..8f4bed69c
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,8 @@
+# Copy to .env and fill in real values for local development. .env is gitignored --
+# never commit real values here or in .env itself.
+
+# Google OAuth client id used by the login/signup and password-reset OAuth flows
+# (see the comment on google_client_id in _config.yml for why this isn't just
+# hardcoded there). Ask a maintainer for the real value -- it's the same one
+# production uses, stored as a GitHub Actions repository secret for CI.
+GOOGLE_CLIENT_ID=
diff --git a/.github/workflows/jekyll-gh-pages.yml b/.github/workflows/jekyll-gh-pages.yml
index ee6b66e0b..fb77a80b4 100644
--- a/.github/workflows/jekyll-gh-pages.yml
+++ b/.github/workflows/jekyll-gh-pages.yml
@@ -101,6 +101,16 @@ jobs:
 
           echo "baseurl: \"$BASEURL\"" > _config.override.yml
 
+          # google_client_id must never be committed to the repo (see the comment on
+          # it in _config.yml) -- injected here from a repository secret instead,
+          # into the same gitignored override file used for baseurl above. Requires
+          # a repo admin to add the GOOGLE_CLIENT_ID secret in Settings > Secrets and
+          # variables > Actions; the site builds fine without it, the Google sign-in
+          # button just won't render until it's set.
+          if [ -n "${{ secrets.GOOGLE_CLIENT_ID }}" ]; then
+            echo "google_client_id: \"${{ secrets.GOOGLE_CLIENT_ID }}\"" >> _config.override.yml
+          fi
+
       - name: Generate dynamic SASS imports
         run: |
           source venv/bin/activate
diff --git a/Makefile b/Makefile
index 5ca228928..7c5dbe161 100644
--- a/Makefile
+++ b/Makefile
@@ -480,11 +480,13 @@ bundle-install:
 	fi
 
 # Start Jekyll server (no auto-watch, we control rebuilds manually)
-# Supports optional _config.local.yml override for local settings (e.g. baseurl)
+# Supports optional _config.local.yml override for local settings (e.g. baseurl,
+# google_client_id -- see scripts/generate_local_config_override.sh and .env.example)
 jekyll-serve: bundle-install
 	@touch /tmp/.notebook_watch_marker
 	@rm -f /tmp/.jekyll_rebuild_trigger
-	bundle exec jekyll serve -H $(HOST) -P $(PORT) --no-watch > $(LOG_FILE) 2>&1 &
+	@./scripts/generate_local_config_override.sh
+	bundle exec jekyll serve -H $(HOST) -P $(PORT) --no-watch --config _config.yml,_config.local.yml > $(LOG_FILE) 2>&1 &
 	@make wait-for-server
 
 # Common server wait logic
diff --git a/_config.yml b/_config.yml
index 680b6c3f7..f6098b903 100644
--- a/_config.yml
+++ b/_config.yml
@@ -20,8 +20,17 @@ description: "Class of 2026"
 owner_name: Open Coding Society 
 github_username: open-coding-society 
 github_repo: "pages" 
-baseurl: "" 
+baseurl: ""
 future: true
+# google_client_id is intentionally NOT set here -- per John Mortensen's review on
+# PR #1371, it must not be committed to the public repo. It's injected at build time
+# into a gitignored override config instead: locally into _config.local.yml via
+# scripts/generate_local_config_override.sh reading .env (see .env.example), in CI
+# into _config.override.yml via the "Compute and apply baseurl" step in
+# .github/workflows/jekyll-gh-pages.yml (which already generates that file for
+# baseurl) reading a repository secret. Either way, assets/js/api/config.js's
+# GOOGLE_CLIENT_ID and login.md's #g_id_onload data-client_id pull the same
+# google_client_id key via Liquid -- one source of truth, just never a committed one.
 
 # Exclude from Jekyll watch - these are processed by our conversion scripts
 # This prevents double-regeneration when saving notebooks/docx files
diff --git a/assets/js/api/config.js b/assets/js/api/config.js
index 461376c64..99e0ea63f 100644
--- a/assets/js/api/config.js
+++ b/assets/js/api/config.js
@@ -23,7 +23,7 @@ if (location.hostname === "localhost" || location.hostname === "127.0.0.1") {
 
 // Shared across the signup, login, and password-reset OAuth flows (login.md,
 // support.md) so the client_id only needs updating in one place.
-export const GOOGLE_CLIENT_ID = "65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com";
+export const GOOGLE_CLIENT_ID = "{{ site.google_client_id }}";
 
 export var javaWebSocketURI;
 if (location.hostname === "localhost" || location.hostname === "127.0.0.1") {
diff --git a/navigation/authentication/login.md b/navigation/authentication/login.md
index a4e76c59c..0440a53fd 100644
--- a/navigation/authentication/login.md
+++ b/navigation/authentication/login.md
@@ -41,7 +41,7 @@ show_reading_time: false
                 <br><strong>You must use an email ending in @stu.powayusd.com or @powayusd.com</strong>
             </p>
             <div id="g_id_onload"
-                 data-client_id="65827797404-ccjleg7jg4g2an8ddpmhnlca4ii2gk8q.apps.googleusercontent.com"
+                 data-client_id="{{ site.google_client_id }}"
                  data-callback="handleGoogleSignIn"
                  data-auto_prompt="false">
             </div>
diff --git a/scripts/generate_local_config_override.sh b/scripts/generate_local_config_override.sh
new file mode 100755
index 000000000..89f5cefc5
--- /dev/null
+++ b/scripts/generate_local_config_override.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Writes _config.local.yml (gitignored -- see Makefile's jekyll-serve comment, this
+# is the file it already documents as "optional _config.local.yml override for local
+# settings") from local .env values that must never be committed to the repo --
+# currently just GOOGLE_CLIENT_ID (see .env.example and the comment on
+# google_client_id in _config.yml). Mirrors the same idea
+# .github/workflows/jekyll-gh-pages.yml uses for CI (its own _config.override.yml,
+# generated fresh each run there), just sourced from a local .env instead of a
+# repository secret. Safe to run even with no .env present: writes a file with
+# google_client_id left unset, and Jekyll serves fine without it (the Google sign-in
+# button just won't render).
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+if [ -f .env ]; then
+    set -a
+    # shellcheck disable=SC1091
+    source .env
+    set +a
+fi
+
+{
+    echo "# Auto-generated by scripts/generate_local_config_override.sh -- do not edit"
+    echo "# or commit; re-run this script (or just start-dev.sh) after editing .env."
+    if [ -n "${GOOGLE_CLIENT_ID:-}" ]; then
+        echo "google_client_id: \"${GOOGLE_CLIENT_ID}\""
+    fi
+} > _config.local.yml