| 34 | // pre-filters the account chooser — a UX hint only (Google treats it as |
| 35 | // advisory); the create-hook gate is the enforcement. |
| 36 | export const ssoProviderConfig = (sso: SsoConfig) => ({ |
| 37 | providerId: sso.providerId, |
| 38 | clientId: sso.clientId, |
| 39 | clientSecret: sso.clientSecret, |
| 40 | discoveryUrl: sso.discoveryUrl, |
| 41 | scopes: ["openid", "email", "profile"], |
| 42 | pkce: true, |
| 43 | ...(sso.providerId === "google" && sso.allowedDomains.length === 1 |
| 44 | ? { authorizationUrlParams: { hd: sso.allowedDomains[0]! } } |
| 45 | : {}), |
| 46 | }); |