fix(users): trace google oauth redirect mismatches

apps/users/tests/test_api_views.py

@@ -1,18 +1,22 @@
 from io import StringIO
 from unittest.mock import Mock, patch
+from urllib.parse import parse_qs, urlparse
 
 from django.conf import settings
 from django.core.cache import cache
 from django.core.management import call_command
 from django.db import IntegrityError
 from django.test import override_settings
-from rest_framework.test import APIRequestFactory
 from rest_framework import status
-from rest_framework.test import APITestCase
+from rest_framework.test import APIRequestFactory, APITestCase
 
 from apps.users.api.views import RegisterWithPasswordView
 from apps.users.models import User, UserSocialAccount
-from apps.users.services.google_oauth import GoogleProfile
+from apps.users.services.google_oauth import (
+    GoogleProfile,
+    build_google_authorization_url,
+    exchange_code_for_google_profile,
+)
 
 
 class UserApiViewTests(APITestCase):
@@ -551,6 +555,42 @@ class GoogleOAuthApiTests(APITestCase):
         self.assertIn("accounts.google.com", response["Location"])
         self.assertIn("state=", response["Location"])
 
+    @patch("apps.users.services.google_oauth.requests.get")
+    @patch("apps.users.services.google_oauth.requests.post")
+    def test_google_token_exchange_uses_the_same_configured_redirect_uri_as_authorization_url(
+        self,
+        requests_post,
+        requests_get,
+    ):
+        auth_url = build_google_authorization_url()
+        parsed_auth_url = urlparse(auth_url)
+        auth_redirect_uri = parse_qs(parsed_auth_url.query)["redirect_uri"][0]
+
+        token_response = Mock()
+        token_response.raise_for_status.return_value = None
+        token_response.json.return_value = {"access_token": "google-access-token"}
+        requests_post.return_value = token_response
+
+        userinfo_response = Mock()
+        userinfo_response.raise_for_status.return_value = None
+        userinfo_response.json.return_value = {
+            "sub": "google-sub-redirect-uri",
+            "email": "redirect@example.com",
+            "email_verified": True,
+            "given_name": "Redirect",
+            "family_name": "Uri",
+            "picture": "https://example.com/avatar.png",
+        }
+        requests_get.return_value = userinfo_response
+
+        exchange_code_for_google_profile("google-auth-code")
+
+        self.assertEqual(
+            requests_post.call_args.kwargs["data"]["redirect_uri"],
+            auth_redirect_uri,
+        )
+        self.assertEqual(auth_redirect_uri, settings.GOOGLE_OAUTH_REDIRECT_URI)
+
     @patch("apps.users.services.google_oauth.requests.get")
     @patch("apps.users.api.views.exchange_code_for_google_profile")
     def test_google_callback_redirects_with_authenticated_flow_for_linked_account(
@@ -995,7 +1035,7 @@ class GoogleOAuthAuditCommandTests(APITestCase):
             password="secret123",
             email="owner@example.com",
         )
-        other_user = User.objects.create_user(
+        User.objects.create_user(
             mobile="09126660002",
             password="secret123",
             email="shared@example.com",