Improve Google auth token error message (#11803)

* Improve error message for invalid Google auth token

* Don't include punctuation in link text

* Add tip about providing full Google client ID

* Update test to check for updated error message

frontend/src/metabase/admin/settings/components/SettingsSingleSignOnForm.jsx

@@ -126,9 +126,12 @@ export default class SettingsSingleSignOnForm extends Component {
                 href="https://developers.google.com/identity/sign-in/web/devconsole-project"
                 target="_blank"
               >
-                here.
+                here
               </a>
-            )}`}
+            )}.`}
+          </p>
+          <p className="text-medium">
+            {t`Be sure to include the full client ID, including the apps.googleusercontent.com suffix.`}
           </p>
           <InputBlurChange
             className="SettingsInput AdminInput bordered rounded h3"

src/metabase/api/session.clj

@@ -271,7 +271,9 @@
        (let [audience (:aud <>)
              audience (if (string? audience) [audience] audience)]
          (when-not (contains? (set audience) client-id)
-           (throw (ex-info (tru "Google Auth token meant for a different site.") {:status-code 400}))))
+           (throw (ex-info (str (deferred-tru "Google Auth token appears to be incorrect. ")
+                                (deferred-tru "Double check that it matches in Google and Metabase."))
+                           {:status-code 400}))))
        (when-not (= (:email_verified <>) "true")
          (throw (ex-info (tru "Email is not verified.") {:status-code 400})))))))
 

test/metabase/api/session_test.clj

@@ -370,7 +370,7 @@
                  [(-> e ex-data :status-code) (.getMessage e)])))))
 
     (testing "for invalid data."
-      (is (= [400 "Google Auth token meant for a different site."]
+      (is (= [400 "Google Auth token appears to be incorrect. Double check that it matches in Google and Metabase."]
              (try
                (#'session-api/google-auth-token-info
                  {:status 200