fix: make Google OAuth callback redirect URI configurable

[Farheen-H-S]

• Map CALLBACK_URL environment variable in env.js
• Update getRedirectUri in auth.controller.js to prioritize CALLBACK_URL with a fallback to localhost
• Add CALLBACK_URL placeholder documentation to .env.example

Description

This Pull Request resolves a limitation in the server-side Google OAuth 2.0 flow by transitioning the hardcoded callback redirect URI to a dynamic configuration.

Root Cause:
Previously, the backend's callback redirect URI was strictly hardcoded to http://localhost:5000/api/auth/google/callback inside the authentication controller. This caused redirect URI mismatch errors (redirect_uri_mismatch) when running in production or staging environments, as the value sent to Google during the authorization exchange did not match the actual public/production domains configured in the Google Cloud Console.

Solution:
I refactored the redirect URI resolution to dynamically retrieve the production callback URL from a CALLBACK_URL environment variable. If undefined, it gracefully falls back to the local development URI (http://localhost:5000/api/auth/google/callback), ensuring zero friction for developers setting up the project locally.

Related Issue

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Code refactoring
• Performance improvement

Changes Made

• Centralized Env Configuration: Mapped process.env.CALLBACK_URL to env.callbackUrl in [env.js] to keep environment variable access unified.
• Dynamic Redirection Resolution: Refactored getRedirectUri in [auth.controller.js]) to evaluate and return env.callbackUrl first, falling back to the local callback path.
• Updated Setup Documentation: Documented the new optional parameter CALLBACK_URL and its default fallback behavior inside [.env.example].

Screenshots (if applicable)

Demonstration video shared directly to Hassan via LinkedIn Message showing successful local server boot and error-free redirect to the Google Account Consent screen.

Testing Done

• Tested on desktop
• Tested on mobile
• Tested on tablet
• No console errors
• All links work
• Forms validate correctly

Checklist

• My code follows the project's code style
• I have commented my code where necessary
• I have updated the documentation
• My changes generate no new warnings
• I have tested my changes thoroughly
• All existing tests pass

Additional Notes

If deploying this to a live/staging environment, remember to add CALLBACK_URL=https://<your-deployed-backend-domain>/api/auth/google/callback to your hosting provider's environment variables dashboard and register the matching URI under Authorized redirect URIs in your Google Developer Console project credentials.

[vercel]

@Farheen-H-S is attempting to deploy a commit to the Portify Team on Vercel.

A member of the Team first needs to authorize it.