From 03cf2f446fa1e8aaab99c26e3f82280a65f114cc Mon Sep 17 00:00:00 2001 From: default Date: Sun, 7 Jun 2026 07:17:39 +0000 Subject: [PATCH] fix(login): only show Google button when client ID looks like a real Google OAuth ID MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, any non-empty AUTH_GOOGLE_ID + AUTH_GOOGLE_SECRET would trigger the Google button. That broke dev/CI setups where the env vars are placeholder strings (e.g. 'dummy-google-client-id') — the button would render and immediately 401 from Google with 'invalid_client'. Real Google OAuth client IDs always end in '.apps.googleusercontent.com'. Gate hasGoogle on that suffix so the login page falls back to the credentials form (or the 'not configured' message) when the values aren't real. --- src/app/login/page.tsx | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/src/app/login/page.tsx b/src/app/login/page.tsx index 4f12947..8795735 100644 --- a/src/app/login/page.tsx +++ b/src/app/login/page.tsx @@ -32,7 +32,19 @@ export default async function LoginPage({ // The Google provider is only added to the Auth.js config when these // two env vars are set. Pass the flag down so the client can hide the // button (and surface a helpful message) when Google is unavailable. - const hasGoogle = !!(process.env.AUTH_GOOGLE_ID && process.env.AUTH_GOOGLE_SECRET); + // + // We also require the client ID to look like a real Google OAuth client + // ID (ends in `.apps.googleusercontent.com`). This guards against + // dev/CI environments where the env vars are set to placeholder strings + // like "dummy-google-client-id" — those would otherwise surface a + // Google button that immediately 401s on Google's end. + const googleId = process.env.AUTH_GOOGLE_ID ?? ""; + const googleSecret = process.env.AUTH_GOOGLE_SECRET ?? ""; + const hasGoogle = !!( + googleId && + googleSecret && + googleId.endsWith(".apps.googleusercontent.com") + ); const hasCredentials = isDevLoginEnabled(); const params = await searchParams; const error =