feat(auth): hide Google sign-in until OAuth is configured

Google social login has no credentials in production, so the "Continue with
Google" button (and its divider) errored on click. Gate the button + divider on
a new isGoogleConfigured() helper (requires GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET)
on both the login and signup pages, and guard the signInWithGoogle action as
defense in depth. The button reappears automatically once both env vars are set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(auth)/login/page.tsx

@@ -3,6 +3,7 @@ import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
 import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signIn, signInWithGoogle } from "@/app/actions/auth"
+import { isGoogleConfigured } from "@/lib/auth"
 
 export const metadata: Metadata = {
   title: "Sign in",
@@ -28,6 +29,8 @@ export default async function LoginPage({
       </div>
 
       <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {isGoogleConfigured() && (
+          <>
             {/* Google OAuth */}
             <form action={signInWithGoogle}>
               <button
@@ -47,6 +50,8 @@ export default async function LoginPage({
                 <span className="bg-[#111118] px-3 text-white/40">or continue with email</span>
               </div>
             </div>
+          </>
+        )}
 
         {/* Error / Success messages */}
         {error && (

app/(auth)/signup/page.tsx

@@ -2,6 +2,7 @@ import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
 import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { signUp, signInWithGoogle } from "@/app/actions/auth"
+import { isGoogleConfigured } from "@/lib/auth"
 
 export default async function SignupPage({
   searchParams,
@@ -47,6 +48,8 @@ export default async function SignupPage({
       </div>
 
       <div className="rounded-xl border border-white/10 bg-[#111118] p-8">
+        {isGoogleConfigured() && (
+          <>
             {/* Google OAuth */}
             <form action={signInWithGoogle}>
               <button
@@ -66,6 +69,8 @@ export default async function SignupPage({
                 <span className="bg-[#111118] px-3 text-white/40">or sign up with email</span>
               </div>
             </div>
+          </>
+        )}
 
         {error && (
           <div className="mb-4 rounded-lg border border-red-500/20 bg-red-500/10 px-4 py-3 text-sm text-red-400">

app/actions/auth.ts

@@ -3,7 +3,7 @@
 import { redirect } from "next/navigation"
 import { headers } from "next/headers"
 import { APIError } from "better-auth/api"
-import { auth } from "@/lib/auth"
+import { auth, isGoogleConfigured } from "@/lib/auth"
 import { verifyTurnstile } from "@/lib/turnstile"
 
 const APP_URL = process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000"
@@ -77,6 +77,11 @@ export async function signIn(formData: FormData) {
 }
 
 export async function signInWithGoogle() {
+  // Defense in depth: the auth pages hide the Google button when it isn't
+  // configured, but guard the action too in case it's POSTed directly.
+  if (!isGoogleConfigured()) {
+    redirect(`/login?error=${encodeURIComponent("Google sign-in isn't available right now.")}`)
+  }
   let url: string | undefined
   try {
     const res = await auth.api.signInSocial({

lib/auth.ts

@@ -116,3 +116,12 @@ export const auth = betterAuth({
   ],
 })
 
+/**
+ * Whether Google OAuth is configured. The auth pages hide the "Continue with
+ * Google" button unless BOTH credentials are present, so users never see a
+ * social option that can't complete. Mirrors socialProviders.google above.
+ */
+export function isGoogleConfigured(): boolean {
+  return Boolean(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET)
+}
+

proxy.ts

@@ -41,6 +41,19 @@ function sentryIngestOrigin(): string | null {
   }
 }
 
+// Origin serving the Umami analytics script (script.js) and receiving its event
+// beacons (POST /api/send). Mirrors the component default so the CSP allows both
+// loading the script AND sending events; stays in sync with NEXT_PUBLIC_UMAMI_SRC
+// when overridden.
+function umamiOrigin(): string {
+  const src = process.env.NEXT_PUBLIC_UMAMI_SRC || "https://fickanalytics.phluit.net/script.js"
+  try {
+    return new URL(src).origin
+  } catch {
+    return ""
+  }
+}
+
 // Build the Content-Security-Policy. `script-src` uses 'unsafe-inline' because
 // Next.js 16's Turbopack build does NOT stamp a per-request nonce onto its
 // inline hydration scripts (`self.__next_f.push(...)`). A nonce-based policy
@@ -54,13 +67,20 @@ function buildCsp(): string {
 
   // Dev additionally needs 'unsafe-eval' (Turbopack HMR) plus a dev websocket
   // (added to connect-src below).
-  const scriptSrc = isDev
-    ? `script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com`
-    : `script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com`
+  const umami = umamiOrigin()
+  const scriptSrc = [
+    "script-src 'self' 'unsafe-inline'",
+    isDev ? "'unsafe-eval'" : "",
+    "https://challenges.cloudflare.com",
+    umami, // load the Umami analytics script
+  ]
+    .filter(Boolean)
+    .join(" ")
   const connectSrc = [
     "connect-src 'self'",
     isDev ? "ws: wss:" : "",
     "https://api.stripe.com https://api.openai.com https://challenges.cloudflare.com",
+    umami, // Umami event beacons (POST /api/send)
     sentry ?? "",
   ]
     .filter(Boolean)