Please address the comments from this code review:
## Overall Comments
- verify_oauth_customer_cred and verify_oauth_business_cred share nearly identical logic; consider extracting the common flow into a helper to reduce duplication and simplify maintenance.
- Avoid exposing your Google client secret in swagger_ui_init_oauth and using it as the session middleware secret—use a distinct server-side secret for sessions and only expose the client ID in the Swagger config.

## Individual Comments

### Comment 1
<location> `fastapi_ecom/utils/basic_auth.py:37` </location>
<code_context>
+
+    if not customer_by_email:
+        return None
+    elif not bcrypt.checkpw(credentials.password.encode('utf-8'), customer_by_email.password.encode('utf-8')):
+        return None
+    else:
</code_context>

<issue_to_address>
No check for None password before encoding in basic auth verification.

Add a check to ensure customer_by_email.password is not None before encoding, to prevent exceptions for users created via OAuth.
</issue_to_address>

### Comment 2
<location> `fastapi_ecom/utils/basic_auth.py:63` </location>
<code_context>
+
+    if not business_by_email:
+        return None
+    elif not bcrypt.checkpw(credentials.password.encode('utf-8'), business_by_email.password.encode('utf-8')):
+        return None
+    else:
</code_context>

<issue_to_address>
No check for None password before encoding in business basic auth verification.

If business_by_email.password is None, encoding will fail. Please add a check to ensure it is not None before encoding.
</issue_to_address>

### Comment 3
<location> `fastapi_ecom/app.py:28` </location>
<code_context>
+        }
     )

+app.add_middleware(SessionMiddleware, secret_key=config.GOOGLE_CLIENT_SECRET)
+
 PREFIX = "/api/v1"
</code_context>

<issue_to_address>
Using the OAuth client secret as the session middleware secret key may be risky.

Use a unique, randomly generated secret for the session middleware to avoid increasing security risks from secret reuse.
</issue_to_address>

### Comment 4
<location> `tests/business/test_business_get.py:146` </location>
<code_context>
+async def test_get_business_me_oauth(
</code_context>

<issue_to_address>
Consider adding a test case for an OIDC user with missing or malformed fields.

Add a test where OIDC user info is missing required fields or contains malformed data to verify proper handling by the authentication logic.

Suggested implementation:

```python
        pytest.param(
            {
                "email": "delete@example.com",
                "name": "delete user",
                "sub": "delete_sub"
            },
            id="BUSINESS GET Endpoint - Fetch email of the `delete` authenticated business with oidc"
        ),
        pytest.param(
            {
                # Missing 'email' and 'sub', malformed 'name'
                "name": 12345
            },
            id="BUSINESS GET Endpoint - OIDC user with missing/malformed fields"
        )
    ]
)

```

```python
async def test_get_business_me_oauth(
        client: AsyncClient,
        db_test_create: None,
        db_test_data: None,
        mock_oidc_user: dict,
        mocker: MockerFixture,
) -> None:
    """
    Test the `get` endpoint for the currently authenticated business of the Business API.

    :param client: The test client to send HTTP requests.
    """
    # If the OIDC user info is missing required fields or contains malformed data,
    # verify that the authentication logic handles it properly.
    if "email" not in mock_oidc_user or "sub" not in mock_oidc_user or not isinstance(mock_oidc_user.get("name", ""), str):
        response = await client.get("/business/me")
        assert response.status_code in (400, 401, 422)
        # Optionally, check for error message in response
        assert "error" in response.json() or "detail" in response.json()
        return

    # Existing test logic for valid OIDC user info goes here...

```
</issue_to_address>

### Comment 5
<location> `tests/business/test_business_get.py:195` </location>
<code_context>
+async def test_get_business_me_oauth_token_issue(
</code_context>

<issue_to_address>
Add a test for expired or revoked OAuth tokens.

Please add a test that mocks the OAuth provider to simulate an expired or revoked token and verifies the correct error response.

Suggested implementation:

```python
@pytest.mark.parametrize(
    "token",
    [
        pytest.param("Bearer", id="BUSINESS GET Endpoint - Invalid Bearer token length"),
        pytest.param("Dummy token", id="BUSINESS GET Endpoint - Dummy Bearer token")
    ]
)
async def test_get_business_me_oauth_token_issue(
        client: AsyncClient,
        db_test_create: None,
        token: str,
        mocker: MockerFixture,
) -> None:
    """
    Test the `get` endpoint for the currently authenticated business of the Business API.

    :param client: The test client to send HTTP requests.
    :param db_test_create: Fixture which creates a test database.

@pytest.mark.asyncio
async def test_get_business_me_oauth_token_expired_or_revoked(
        client: AsyncClient,
        db_test_create: None,
        mocker: MockerFixture,
) -> None:
    """
    Test the `get` endpoint for the currently authenticated business with an expired or revoked OAuth token.

    This test mocks the OAuth provider to simulate an expired or revoked token and verifies the correct error response.
    """
    # Simulate an expired/revoked token
    expired_token = "Bearer expired_or_revoked_token"

    # Mock the OAuth provider's introspection/validation endpoint to return invalid token
    mocker.patch(
        "path.to.oauth_validation_function",  # Replace with actual import path
        return_value=False  # Simulate token is invalid
    )

    response = await client.get(
        "/api/business/me",
        headers={"Authorization": expired_token}
    )

    assert response.status_code == 401
    assert "invalid" in response.text.lower() or "expired" in response.text.lower() or "revoked" in response.text.lower()

```

- Replace `"path.to.oauth_validation_function"` with the actual import path or function used in your codebase to validate OAuth tokens.
- If your codebase uses a different error message or status code for expired/revoked tokens, adjust the assertions accordingly.
- Ensure that the test client and endpoint (`/api/business/me`) match your actual API.
</issue_to_address>

### Comment 6
<location> `tests/customer/test_customer_get.py:146` </location>
<code_context>
+async def test_get_customer_me_oauth(
</code_context>

<issue_to_address>
Consider adding a test for OIDC users with duplicate emails in both basic and OAuth records.

Please add a test to ensure that when a user exists in both basic and OAuth records with the same email, the correct record is updated and returned, and duplicates are not created.

Suggested implementation:

```python
async def test_get_customer_me_oauth(
        client: AsyncClient,
        db_test_create: None,
        db_test_data: None,
        mock_oidc_user,
        mocker: MockerFixture,
) -> None:
    """
    Test the `get` endpoint for the currently authenticated customer of the Business API.

    :param client: The test client to send HTTP requests.
    """

@pytest.mark.asyncio
async def test_get_customer_me_oidc_duplicate_email(
        client: AsyncClient,
        db_test_create: None,
        db_test_data: None,
        mock_oidc_user,
        mocker: MockerFixture,
) -> None:
    """
    Test that when a user exists in both basic and OAuth records with the same email,
    the correct record is updated and returned, and duplicates are not created.
    """
    # Setup: create a basic user and an OAuth user with the same email
    email = "duplicate@example.com"
    basic_user_data = {
        "email": email,
        "name": "Basic User",
        "sub": None
    }
    oauth_user_data = {
        "email": email,
        "name": "OAuth User",
        "sub": "oauth_sub_123"
    }

    # Insert basic user
    await db_test_create("customer", basic_user_data)
    # Insert OAuth user
    await db_test_create("customer", oauth_user_data)

    # Mock OIDC user to authenticate as the OAuth user
    mock_oidc_user.return_value = oauth_user_data

    # Make request to /customer/me endpoint
    response = await client.get("/customer/me")
    assert response.status_code == 200
    data = response.json()

    # Ensure the returned record is the OAuth user
    assert data["email"] == email
    assert data["sub"] == "oauth_sub_123"
    assert data["name"] == "OAuth User"

    # Ensure no duplicate customer records exist for the same email
    # (Assuming db_test_data returns all customers)
    all_customers = await db_test_data("customer")
    emails = [c["email"] for c in all_customers]
    assert emails.count(email) == 1

```

- If your test database setup or helper functions (`db_test_create`, `db_test_data`) differ, you may need to adjust the test setup and assertions accordingly.
- Ensure that the `/customer/me` endpoint logic merges or updates records as expected for OIDC users with duplicate emails.
</issue_to_address>

### Comment 7
<location> `tests/customer/test_customer_get.py:195` </location>
<code_context>
+async def test_get_customer_me_oauth_token_issue(
</code_context>

<issue_to_address>
Add a test for OAuth tokens with incorrect type (e.g., not 'Bearer').

Please include a test case for tokens with an incorrect type to verify they are properly rejected.

Suggested implementation:

```python
@pytest.mark.parametrize(
    "token",
    [
        pytest.param("Bearer", id="CUSTOMER GET Endpoint - Invalid Bearer token length"),
        pytest.param("Dummy token", id="CUSTOMER GET Endpoint - Dummy Bearer token"),
        pytest.param("Basic abcdef12345", id="CUSTOMER GET Endpoint - Incorrect token type"),
    ]
)

```

Make sure that the test implementation for `test_get_customer_me_oauth_token_issue` asserts the correct rejection behavior (e.g., status code 401 or 403) for tokens with incorrect types. If the test currently only checks for "Bearer" tokens, you may need to update the assertion logic to handle this new case.
</issue_to_address>