From 76a41d70b0150b59081e0087c8954e16bfad6a05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Sat, 9 May 2026 10:51:46 +0200
Subject: [PATCH 1/2] Dual read for google oauth secret

Will allow future support for more params
---
 src/Appwrite/Auth/OAuth2/Google.php | 33 +++++++++++++++++++++++++++--
 1 file changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/Appwrite/Auth/OAuth2/Google.php b/src/Appwrite/Auth/OAuth2/Google.php
index 79894c2422..0ee495df7d 100644
--- a/src/Appwrite/Auth/OAuth2/Google.php
+++ b/src/Appwrite/Auth/OAuth2/Google.php
@@ -72,7 +72,7 @@ class Google extends OAuth2
                 'https://oauth2.googleapis.com/token?' . \http_build_query([
                     'code' => $code,
                     'client_id' => $this->appID,
-                    'client_secret' => $this->appSecret,
+                    'client_secret' => $this->getClientSecret(),
                     'redirect_uri' => $this->callback,
                     'scope' => null,
                     'grant_type' => 'authorization_code'
@@ -95,7 +95,7 @@ class Google extends OAuth2
             'https://oauth2.googleapis.com/token?' . \http_build_query([
                 'refresh_token' => $refreshToken,
                 'client_id' => $this->appID,
-                'client_secret' => $this->appSecret,
+                'client_secret' => $this->getClientSecret(),
                 'grant_type' => 'refresh_token'
             ])
         ), true);
@@ -177,4 +177,33 @@ class Google extends OAuth2
 
         return $this->user;
     }
+
+    /**
+     * Extracts the Client Secret from the JSON stored in appSecret
+     *
+     * @return string
+     */
+    protected function getClientSecret(): string
+    {
+        $secret = $this->getAppSecret();
+
+        return $secret['clientSecret'] ?? '';
+    }
+
+    /**
+     * Decode the JSON stored in appSecret.
+     * Falls back to treating the raw string as the client secret for backwards compatibility.
+     *
+     * @return array
+     */
+    protected function getAppSecret(): array
+    {
+        try {
+            $secret = \json_decode($this->appSecret, true, 512, JSON_THROW_ON_ERROR);
+        } catch (\Throwable $th) {
+            return ['clientSecret' => $this->appSecret];
+        }
+
+        return $secret;
+    }
 }

From 0e939ea9d747c1bf38ace4555623acc92927e010 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Matej=20Ba=C4=8Do?= <matejbaco2000@gmail.com>
Date: Sat, 9 May 2026 12:58:47 +0200
Subject: [PATCH 2/2] PR review fixes

---
 src/Appwrite/Auth/OAuth2/Google.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/Appwrite/Auth/OAuth2/Google.php b/src/Appwrite/Auth/OAuth2/Google.php
index 0ee495df7d..6028bd109b 100644
--- a/src/Appwrite/Auth/OAuth2/Google.php
+++ b/src/Appwrite/Auth/OAuth2/Google.php
@@ -187,7 +187,7 @@ class Google extends OAuth2
     {
         $secret = $this->getAppSecret();
 
-        return $secret['clientSecret'] ?? '';
+        return $secret['clientSecret'] ?? $this->appSecret;
     }
 
     /**
@@ -204,6 +204,10 @@ class Google extends OAuth2
             return ['clientSecret' => $this->appSecret];
         }
 
+        if (!\is_array($secret)) {
+            return ['clientSecret' => $this->appSecret];
+        }
+
         return $secret;
     }
 }