Spec a hand-built Google sign-in for a Flask app

Your Python Flask app needs a "Sign in with Google" button. The team decided against an auth service, so a coding agent will hand-write the OpenID Connect flow against Google's endpoints. In that flow, Google sends the user back with a one-time code, and your server trades it for an ID token: a signed statement of who the user is.

Write the build spec you would hand the agent: the steps of the flow, the security rules, session handling and the acceptance checks.

What you know:

• the client id and secret are in GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, and the registered redirect URI is https://app.example.com/auth/google/callback
• PyJWT is already a dependency
• existing users signed up with an email and password, and some will now sign in with Google
• the login link can carry a next parameter, the page to return to after sign-in

Then, in a few sentences: what does "implement Google login" leave dangerously wrong?