feat(auth): hide Google sign-in until OAuth is configured

Google social login has no credentials in production, so the "Continue with
Google" button (and its divider) errored on click. Gate the button + divider on
a new isGoogleConfigured() helper (requires GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET)
on both the login and signup pages, and guard the signInWithGoogle action as
defense in depth. The button reappears automatically once both env vars are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(auth)/login/page.tsx

@@ -3,6 +3,7 @@ import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
 import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signIn, signInWithGoogle } from "@/app/actions/auth"
+import { isGoogleConfigured } from "@/lib/auth"
 
 export const metadata: Metadata = {
   title: "Sign in",
@@ -28,25 +29,29 @@ export default async function LoginPage({
       </div>
 
       <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
-        {/* Google OAuth */}
+        {isGoogleConfigured() && (
-        <form action={signInWithGoogle}>
+          <>
-          <button
+            {/* Google OAuth */}
-            type="submit"
+            <form action={signInWithGoogle}>
-            className="flex w-full items-center justify-center gap-3 rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm font-medium text-white transition hover:bg-white/10"
+              <button
-          >
+                type="submit"
-            <GoogleIcon />
+                className="flex w-full items-center justify-center gap-3 rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm font-medium text-white transition hover:bg-white/10"
-            Continue with Google
+              >
-          </button>
+                <GoogleIcon />
-        </form>
+                Continue with Google
+              </button>
+            </form>
 
-        <div className="relative my-6">
+            <div className="relative my-6">
-          <div className="absolute inset-0 flex items-center">
+              <div className="absolute inset-0 flex items-center">
-            <div className="w-full border-t border-white/10" />
+                <div className="w-full border-t border-white/10" />
-          </div>
+              </div>
-          <div className="relative flex justify-center text-xs">
+              <div className="relative flex justify-center text-xs">
-            <span className="bg-[#111118] px-3 text-white/40">or continue with email</span>
+                <span className="bg-[#111118] px-3 text-white/40">or continue with email</span>
-          </div>
+              </div>
-        </div>
+            </div>
+          </>
+        )}
 
         {/* Error / Success messages */}
         {error && (

app/(auth)/signup/page.tsx

@@ -2,6 +2,7 @@ import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
 import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signUp, signInWithGoogle } from "@/app/actions/auth"
+import { isGoogleConfigured } from "@/lib/auth"
 
 export default async function SignupPage({
   searchParams,
@@ -47,25 +48,29 @@ export default async function SignupPage({
       </div>
 
       <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
-        {/* Google OAuth */}
+        {isGoogleConfigured() && (
-        <form action={signInWithGoogle}>
+          <>
-          <button
+            {/* Google OAuth */}
-            type="submit"
+            <form action={signInWithGoogle}>
-            className="flex w-full items-center justify-center gap-3 rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm font-medium text-white transition hover:bg-white/10"
+              <button
-          >
+                type="submit"
-            <GoogleIcon />
+                className="flex w-full items-center justify-center gap-3 rounded-lg border border-white/10 bg-white/5 px-4 py-2.5 text-sm font-medium text-white transition hover:bg-white/10"
-            Continue with Google
+              >
-          </button>
+                <GoogleIcon />
-        </form>
+                Continue with Google
+              </button>
+            </form>
 
-        <div className="relative my-6">
+            <div className="relative my-6">
-          <div className="absolute inset-0 flex items-center">
+              <div className="absolute inset-0 flex items-center">
-            <div className="w-full border-t border-white/10" />
+                <div className="w-full border-t border-white/10" />
-          </div>
+              </div>
-          <div className="relative flex justify-center text-xs">
+              <div className="relative flex justify-center text-xs">
-            <span className="bg-[#111118] px-3 text-white/40">or sign up with email</span>
+                <span className="bg-[#111118] px-3 text-white/40">or sign up with email</span>
-          </div>
+              </div>
-        </div>
+            </div>
+          </>
+        )}
 
         {error && (
           <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">

app/actions/auth.ts

@@ -3,7 +3,7 @@
 import { redirect } from "next/navigation"
 import { headers } from "next/headers"
 import { APIError } from "better-auth/api"
-import { auth } from "@/lib/auth"
+import { auth, isGoogleConfigured } from "@/lib/auth"
 import { verifyTurnstile } from "@/lib/turnstile"
 
 const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000"
@@ -77,6 +77,11 @@ export async function signIn(formData: FormData) {
 }
 
 export async function signInWithGoogle() {
+  // Defense in depth: the auth pages hide the Google button when it isn't
+  // configured, but guard the action too in case it's POSTed directly.
+  if (!isGoogleConfigured()) {
+    redirect(`/login?error=${encodeURIComponent("Google sign-in isn't available right now.")}`)
+  }
   let url: string | undefined
   try {
     const res = await auth.api.signInSocial({

lib/auth.ts

@@ -116,3 +116,12 @@ export const auth = betterAuth({
   ],
 })
 
+/**
+ * Whether Google OAuth is configured. The auth pages hide the "Continue with
+ * Google" button unless BOTH credentials are present, so users never see a
+ * social option that can't complete. Mirrors socialProviders.google above.
+ */
+export function isGoogleConfigured(): boolean {
+  return Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET)
+}
+