fix: CORS for Google Docs export and add debug logging

- Allow localhost (any port), 127.0.0.1, and 192.168.x.x origins
- Add console logging for auth token debugging
- The token IS working (confirmed locally) - issue was CORS

Author: Programcode

src/lib/export-utils.ts

@@ -438,10 +438,14 @@ async function callGoogleDocsEdgeFunction(
     // Try session.provider_token first, fallback to localStorage
     // Supabase only provides provider_token immediately after OAuth, not on session refresh
     let providerToken = session.provider_token;
+    const tokenSource = providerToken ? 'session' : 'localStorage';
     if (!providerToken) {
       providerToken = localStorage.getItem('google_provider_token');
     }
 
+    console.log('[GDocs Export] Token source:', tokenSource, 'Token present:', !!providerToken,
+      'Token preview:', providerToken ? `${providerToken.substring(0, 10)}...` : 'none');
+
     if (!providerToken) {
       return {
         success: false,

src/lib/supabase/AuthProvider.tsx

@@ -39,7 +39,9 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
     init();
 
-    const { data: authListener } = supabase.auth.onAuthStateChange((_event, newSession) => {
+    const { data: authListener } = supabase.auth.onAuthStateChange((event, newSession) => {
+      console.log('[Auth] Event:', event, 'Provider Token:', newSession?.provider_token ? 'present' : 'null');
+
       const prevUserId = session?.user?.id;
       const nextUserId = newSession?.user?.id;
       setSession(newSession);
@@ -48,6 +50,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       // Persist Google provider_token for later use (e.g., Google Docs export)
       // This token is only available immediately after OAuth, not on session refresh
       if (newSession?.provider_token) {
+        console.log('[Auth] Storing new provider_token');
         localStorage.setItem('google_provider_token', newSession.provider_token);
       }
 

supabase/functions/export-gdoc/index.ts

@@ -5,11 +5,21 @@
 const ALLOWED_ORIGINS = [
     "https://debate.pi-stack.org",
     "http://localhost:5173",
+    "http://localhost:8080",
     "http://127.0.0.1:54321"
 ];
 
 function getCorsHeaders(origin: string | null) {
-    const allowedOrigin = origin && ALLOWED_ORIGINS.includes(origin) ? origin : ALLOWED_ORIGINS[0];
+    // Allow any localhost/127.0.0.1 origin for development
+    // Also allow local network IPs (192.168.x.x) for mobile/device testing
+    const isDevOrigin = origin && (
+        origin.startsWith('http://localhost') ||
+        origin.startsWith('http://127.0.0.1') ||
+        origin.startsWith('http://192.168.')
+    );
+    const allowedOrigin = isDevOrigin || (origin && ALLOWED_ORIGINS.includes(origin))
+        ? origin
+        : ALLOWED_ORIGINS[0];
     return {
         "Access-Control-Allow-Origin": allowedOrigin,
         "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",