🔐 Authentication Testing Guide

Step 1: Basic Authentication Flow

Step 2: API Endpoint Tests

Step 3: Authorization Tests

For New Users (First Time Testing)

1. Navigate to /login.html or any protected page
2. Click "Sign in with Google" button
3. Complete Google OAuth flow in popup
4. Verify you're redirected back and see your email displayed
5. Test accessing protected resources like /firebase-test.html

For Returning Users (Testing Persistence)

1. Close all browser tabs/windows
2. Open a new browser window
3. Navigate directly to a protected page
4. Verify you're automatically authenticated (no login required)
5. Test that your session persists across page reloads

For Advanced Testing (Token Management)

1. Open browser developer console
2. Run: window.getAuthDiagnostics()
3. Check localStorage for authentication tokens
4. Test token refresh by waiting 50+ minutes
5. Verify graceful handling of expired tokens

Problem: "Sign in popup blocked"

Solution: Allow popups for this domain in your browser settings, or try using an incognito window.

Problem: "Token expired" errors

Solution: Sign out and sign back in. Check if your system clock is correct.

Problem: "Access denied to protected resources"

Solution: Verify your email is authorized in Firebase console, and check Cloud Functions logs.

Problem: "Authentication state inconsistent"

Solution: Clear browser data for this site and re-authenticate.