[setup] Register the Jaah Google Analytics OAuth

**User-only setup task.** Only a person can do the registration steps below (it needs a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps yourself and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they answer that it is done, run the **Runner validation** section on dev and settle with `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, say exactly which step looks wrong and ask once more. A person must do this: registering an app at Google Analytics needs a human sign-in at Google. It lets members connect Google Analytics to Jaah with one **Connect Google Analytics** button, without registering an app of their own. ## Steps 1. Sign in to Google with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://console.cloud.google.com/auth/clients 2. Create a new OAuth app. Name it **Jaah**. 3. One Google Cloud OAuth client can serve every Jaah Google integration. If the Jaah Google Search Console app is already registered, reuse its project and client: add the scope below under Google Auth Platform > Data access, skip to the redirect URI step, and pick the same oauth_app secret in this vendor's knob. 4. In the Google Cloud console project picker, select or create the project named jaah-integrations. 5. Open APIs & Services > Library, search for Google Analytics Admin API and select Enable, then do the same for Google Analytics Data API. 6. Open Google Auth Platform > Branding. Set App name to Jaah, the user support email to the shared support mailbox, Application home page to the public homepage of the company that runs this Jaah (its https address), Privacy policy and Terms of service to that company's privacy policy and terms pages, and add its domain under Authorized domains. Select Save. 7. Open Google Auth Platform > Audience. Choose External, then select Publish app so the app is In production rather than Testing (Testing refresh tokens expire after 7 days). 8. Open Google Auth Platform > Data access, select Add or remove scopes, tick .../auth/analytics.readonly and select Update, then Save. 9. Open Google Auth Platform > Clients, select Create client, choose Application type Web application and name it Jaah. This client is the OAuth app: the redirect URIs (a later step) go under its Authorized redirect URIs, then select Create. 10. Add both redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 11. Request exactly these scopes: `https://www.googleapis.com/auth/analytics.readonly`. Why each one is needed is in the table below. 12. Copy the app's client ID and client secret. Keep them in your password manager only until the next step is done. 13. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-google_analytics-app`, with provider `google_analytics`, the client ID and the client secret. 14. Open **Settings > Integrations > OAuth apps > Google Analytics** and pick that secret in the knob `oauth_app.google_analytics`. 15. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `https://www.googleapis.com/auth/analytics.readonly` | Read your Analytics accounts, properties and reports, so agents can answer traffic and conversion questions. Read only: agents cannot change settings | ## Redirect URIs - dev: `https://app.dev.jaah.ai/api/credentials/connect/callback` - prod: `https://app.jaah.ai/api/credentials/connect/callback` ## Review or verification Google verification: analytics.readonly is listed under Data access; if Google marks it sensitive, submit the app in Google Auth Platform > Verification Center. Until verified, members see an unverified-app warning and the app is capped at 100 users. ## Runner validation A runner checks the setup once you mark this task answered: on dev, **Connect Google Analytics** with the Jaah app ends on **Connected** and **Test** passes. It reads only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste the client ID or secret into this task, a comment, a log or a report. ## Done means - The operator confirmed the steps are done. - On dev, the Google Analytics Connect screen no longer says "Jaah app not configured", the consent round trip ends on **Connected**, and **Test** passes — cited from what you observed.