1. Enable student Google sign-in
Create a Google OAuth Web application client. Add this authorized JavaScript origin:
YOUR_PORTAL_ORIGIN
Set GOOGLE_CLIENT_ID in Cloudflare Worker runtime settings. Student sign-in uses only basic identity information; it does not ask for student Drive access. No student email list is required.
Google sign-in setup instructions
2. Authorize the advisor’s Drive connection
Verified owner: vsi.core.lab@gmail.com. All 20 student folders have been created in Weekly Reports. The destination was private when the folders were created. No student sharing permissions were added.
Browser login and the ChatGPT Drive connection do not authorize the website’s server. Enable the Google Drive API and authorize an owner OAuth client for offline Drive access under this account. The existing folders require an authorization that can access them; a basic sign-in token is insufficient.
In Cloudflare Worker runtime settings, configure VSI_DRIVE_CLIENT_ID, VSI_DRIVE_CLIENT_SECRET, and VSI_DRIVE_REFRESH_TOKEN. Mark the secret and refresh token as secrets. Obtain the refresh token through Google’s server OAuth authorization flow with the owner’s consent. Do not paste credentials into chat, source files, or the browser form. Redeploy after changing runtime settings.
Google’s offline authorization instructions
3. Confirm each student once
The student signs in with Google, types at least two letters, and selects their name. Sign into the portal with vsi.core.lab@gmail.com, then open Student connections and approve the matching account. Future visits restore that student automatically. A typed name alone never grants access to a private folder.
4. Check one complete submission
The server stores the report, then copies original attachments and a readable TXT report into student name / submission date. Each submission has its own reference in the filenames. Retries reuse the same Drive file IDs. The TXT includes the next-week plan; the following week’s form reads it from Drive. Delivery is confirmed only after every file has been verified.
Until the server Drive connection is configured, the portal shows that reports are saved to the portal only. If Drive delivery fails, the original report remains available and the student can retry.
5. Confirm hosting access
This standalone deployment uses Google sign-in and advisor-confirmed student connections. Register the actual HTTPS origin of this deployment in Google Cloud before inviting students. Private reports remain protected by server-side account checks. The advisor platform connection is a separate task.