feat(auth): hide Google sign-in until OAuth is configured

Google social login has no credentials in production, so the "Continue with
Google" button (and its divider) errored on click. Gate the button + divider on
a new isGoogleConfigured() helper (requires GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET)
on both the login and signup pages, and guard the signInWithGoogle action as
defense in depth. The button reappears automatically once both env vars are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(auth)/login/page.tsx

@@ -3,6 +3,7 @@ import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
 import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signIn, signInWithGoogle } from "@/app/actions/auth"
+import { isGoogleConfigured } from "@/lib/auth"
 
 export const metadata: Metadata = {
   title: "Sign in",
@@ -28,6 +29,8 @@ export default async function LoginPage({
       </div>
 
       <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {isGoogleConfigured() && (
+          <>
             {/* Google OAuth */}
             <form action={signInWithGoogle}>
               <button
@@ -47,6 +50,8 @@ export default async function LoginPage({
                 <span className="bg-[#111118] px-3 text-white/40">or continue with email</span>
               </div>
             </div>
+          </>
+        )}
 
         {/* Error / Success messages */}
         {error && (

app/(auth)/signup/page.tsx

@@ -2,6 +2,7 @@ import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
 import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signUp, signInWithGoogle } from "@/app/actions/auth"
+import { isGoogleConfigured } from "@/lib/auth"
 
 export default async function SignupPage({
   searchParams,
@@ -47,6 +48,8 @@ export default async function SignupPage({
       </div>
 
       <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {isGoogleConfigured() && (
+          <>
             {/* Google OAuth */}
             <form action={signInWithGoogle}>
               <button
@@ -66,6 +69,8 @@ export default async function SignupPage({
                 <span className="bg-[#111118] px-3 text-white/40">or sign up with email</span>
               </div>
             </div>
+          </>
+        )}
 
         {error && (
           <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">

app/actions/auth.ts

@@ -3,7 +3,7 @@
 import { redirect } from "next/navigation"
 import { headers } from "next/headers"
 import { APIError } from "better-auth/api"
-import { auth } from "@/lib/auth"
+import { auth, isGoogleConfigured } from "@/lib/auth"
 import { verifyTurnstile } from "@/lib/turnstile"
 
 const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000"
@@ -77,6 +77,11 @@ export async function signIn(formData: FormData) {
 }
 
 export async function signInWithGoogle() {
+  // Defense in depth: the auth pages hide the Google button when it isn't
+  // configured, but guard the action too in case it's POSTed directly.
+  if (!isGoogleConfigured()) {
+    redirect(`/login?error=${encodeURIComponent("Google sign-in isn't available right now.")}`)
+  }
   let url: string | undefined
   try {
     const res = await auth.api.signInSocial({

lib/auth.ts

@@ -116,3 +116,12 @@ export const auth = betterAuth({
   ],
 })
 
+/**
+ * Whether Google OAuth is configured. The auth pages hide the "Continue with
+ * Google" button unless BOTH credentials are present, so users never see a
+ * social option that can't complete. Mirrors socialProviders.google above.
+ */
+export function isGoogleConfigured(): boolean {
+  return Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET)
+}
+