From f6331e722985aeac4723f6780b0a7f092f38ed89 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 22 May 2026 17:04:51 +0300
Subject: [PATCH 1/3] feat(auth): auto-hide OAuth buttons when secrets absent;
 add ALLOW_REGISTRATION toggle

OAuth provider buttons (GitHub, Google) are now derived from server-side
env vars at runtime via /api/auth/config, removing the error-prone manual
NEXT_PUBLIC_SHOW_* flags. Setting ALLOW_REGISTRATION=false blocks sign-up
at both the API layer (Better-Auth /sign-up/email and custom /register)
and hides the register toggle in the UI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .env.example                           |  5 +--
 web/.env.example                       | 17 +++++----
 web/src/app/api/auth/[...all]/route.ts | 13 ++++++-
 web/src/app/api/auth/config/route.ts   |  9 +++++
 web/src/app/api/auth/register/route.ts |  4 +++
 web/src/app/login/page.tsx             | 50 ++++++++++++++++----------
 6 files changed, 68 insertions(+), 30 deletions(-)
 create mode 100644 web/src/app/api/auth/config/route.ts

diff --git a/.env.example b/.env.example
index 3d5dae7..b7fa474 100644
--- a/.env.example
+++ b/.env.example
@@ -116,10 +116,11 @@ CACHE_DIR=/app/data/cache
 BETTER_AUTH_URL=http://localhost:3000    # Public URL of the web app (used for cookie security + trusted origins)
 FRONTEND_URL=                            # Set if different from BETTER_AUTH_URL (e.g. custom domain)
 AUTH_SECRET=change-me-in-development
-GITHUB_CLIENT_ID=
+GITHUB_CLIENT_ID=                       # Leave blank to hide "Sign in with GitHub"
 GITHUB_CLIENT_SECRET=
-GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_ID=                       # Leave blank to hide "Sign in with Google"
 GOOGLE_CLIENT_SECRET=
+ALLOW_REGISTRATION=true                 # Set to false to disable self-service account creation
 
 # RS256 JWT keys (cross-service auth: app → backend)
 # Generate with:
diff --git a/web/.env.example b/web/.env.example
index 4d6a24f..e0135dd 100644
--- a/web/.env.example
+++ b/web/.env.example
@@ -1,17 +1,16 @@
 # NextAuth.js
 AUTH_SECRET=change-me-in-development  # Generate for production with: openssl rand -base64 32
 
-# GitHub OAuth App
-GITHUB_CLIENT_ID=your-github-client-id
-GITHUB_CLIENT_SECRET=your-github-client-secret
+# GitHub OAuth App — leave blank to hide the "Sign in with GitHub" button
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
 
-# Google OAuth App
-GOOGLE_CLIENT_ID=your-google-client-id
-GOOGLE_CLIENT_SECRET=your-google-client-secret
+# Google OAuth App — leave blank to hide the "Sign in with Google" button
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
 
-# Login page — show OAuth buttons (omit to show credentials-only)
-NEXT_PUBLIC_SHOW_GITHUB=true
-NEXT_PUBLIC_SHOW_GOOGLE=true
+# Set to false to disable self-service account creation (UI toggle and API both blocked)
+ALLOW_REGISTRATION=true
 
 # Atlassian OAuth 2.0 + PKCE — client-side only, no secret required.
 # Register an OAuth 2.0 (3LO) app at https://developer.atlassian.com/console/myapps/
diff --git a/web/src/app/api/auth/[...all]/route.ts b/web/src/app/api/auth/[...all]/route.ts
index 9900a3b..3881e3a 100644
--- a/web/src/app/api/auth/[...all]/route.ts
+++ b/web/src/app/api/auth/[...all]/route.ts
@@ -1,4 +1,15 @@
 import { auth } from '@/lib/auth';
 import { toNextJsHandler } from 'better-auth/next-js';
+import { NextRequest, NextResponse } from 'next/server';
 
-export const { GET, POST } = toNextJsHandler(auth);
+const handlers = toNextJsHandler(auth);
+
+export const GET = handlers.GET;
+
+export async function POST(request: NextRequest) {
+  const url = new URL(request.url);
+  if (process.env.ALLOW_REGISTRATION === 'false' && url.pathname.endsWith('/sign-up/email')) {
+    return NextResponse.json({ error: 'Registration is disabled' }, { status: 403 });
+  }
+  return handlers.POST(request);
+}
diff --git a/web/src/app/api/auth/config/route.ts b/web/src/app/api/auth/config/route.ts
new file mode 100644
index 0000000..ec9574a
--- /dev/null
+++ b/web/src/app/api/auth/config/route.ts
@@ -0,0 +1,9 @@
+import { NextResponse } from 'next/server';
+
+export async function GET() {
+  return NextResponse.json({
+    github: !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET),
+    google: !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),
+    registrationEnabled: process.env.ALLOW_REGISTRATION !== 'false',
+  });
+}
diff --git a/web/src/app/api/auth/register/route.ts b/web/src/app/api/auth/register/route.ts
index 2f4981c..19da03d 100644
--- a/web/src/app/api/auth/register/route.ts
+++ b/web/src/app/api/auth/register/route.ts
@@ -2,6 +2,10 @@ import { NextResponse } from 'next/server';
 import { auth } from '@/lib/auth';
 
 export async function POST(request: Request) {
+  if (process.env.ALLOW_REGISTRATION === 'false') {
+    return NextResponse.json({ error: 'Registration is disabled' }, { status: 403 });
+  }
+
   let body: { username?: string; password?: string; email?: string };
   try {
     body = await request.json();
diff --git a/web/src/app/login/page.tsx b/web/src/app/login/page.tsx
index 30252d2..957ee4a 100644
--- a/web/src/app/login/page.tsx
+++ b/web/src/app/login/page.tsx
@@ -1,7 +1,7 @@
 'use client';
 
 import { useSearchParams } from 'next/navigation';
-import { FormEvent, Suspense, useCallback, useState } from 'react';
+import { FormEvent, Suspense, useCallback, useEffect, useState } from 'react';
 import {
   Box,
   Button,
@@ -17,9 +17,6 @@ import GoogleIcon from '@mui/icons-material/Google';
 import { createAppTheme } from '../../spa/theme';
 import { useThemeMode } from '../../spa/hooks/useThemeMode';
 
-const showGithub = process.env.NEXT_PUBLIC_SHOW_GITHUB !== 'false';
-const showGoogle = process.env.NEXT_PUBLIC_SHOW_GOOGLE !== 'false';
-
 function LoginForm() {
   const searchParams = useSearchParams();
   const error = searchParams.get('error');
@@ -31,6 +28,11 @@ function LoginForm() {
       ? rawCallback
       : '/';
 
+  const [authConfig, setAuthConfig] = useState<{
+    github: boolean;
+    google: boolean;
+    registrationEnabled: boolean;
+  } | null>(null);
   const [mode, setMode] = useState<'login' | 'register'>('login');
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
@@ -38,6 +40,16 @@ function LoginForm() {
   const [formError, setFormError] = useState<string | null>(null);
   const [loading, setLoading] = useState(false);
 
+  useEffect(() => {
+    fetch('/api/auth/config')
+      .then((r) => r.json())
+      .then((cfg) => {
+        setAuthConfig(cfg);
+        if (!cfg.registrationEnabled) setMode('login');
+      })
+      .catch(() => setAuthConfig({ github: false, google: false, registrationEnabled: true }));
+  }, []);
+
   const handleCredentialsLogin = useCallback(
     async (e: FormEvent) => {
       e.preventDefault();
@@ -198,19 +210,21 @@ function LoginForm() {
           </Button>
         </Box>
 
-        <Button
-          variant="text"
-          size="small"
-          onClick={() => {
-            setMode(mode === 'login' ? 'register' : 'login');
-            setFormError(null);
-          }}
-          sx={{ textTransform: 'none' }}
-        >
-          {mode === 'login' ? 'Create an account' : 'Already have an account? Sign in'}
-        </Button>
+        {authConfig?.registrationEnabled && (
+          <Button
+            variant="text"
+            size="small"
+            onClick={() => {
+              setMode(mode === 'login' ? 'register' : 'login');
+              setFormError(null);
+            }}
+            sx={{ textTransform: 'none' }}
+          >
+            {mode === 'login' ? 'Create an account' : 'Already have an account? Sign in'}
+          </Button>
+        )}
 
-        {(showGithub || showGoogle) && (
+        {(authConfig?.github || authConfig?.google) && (
           <>
             <Divider sx={{ width: '100%' }}>
               <Typography variant="body2" color="text.secondary">
@@ -218,7 +232,7 @@ function LoginForm() {
               </Typography>
             </Divider>
             <Box sx={{ display: 'flex', flexDirection: 'column', gap: 1.5, width: '100%' }}>
-              {showGithub && (
+              {authConfig.github && (
                 <Button
                   variant="outlined"
                   size="large"
@@ -235,7 +249,7 @@ function LoginForm() {
                   Sign in with GitHub
                 </Button>
               )}
-              {showGoogle && (
+              {authConfig.google && (
                 <Button
                   variant="outlined"
                   size="large"

From acb8a3a8fe03fc8ec82e18bb92d0ae42419e4f5b Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 22 May 2026 17:21:12 +0300
Subject: [PATCH 2/3] =?UTF-8?q?fix(auth):=20address=20PR=20review=20?=
 =?UTF-8?q?=E2=80=94=20context=20forwarding,=20exact=20path=20match,=20cac?=
 =?UTF-8?q?he=20header,=20optimistic=20UI,=20tests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Forward Next.js context param in catch-all POST (Better-Auth ignores it, but satisfies type contract)
- Use exact pathname equality for sign-up block (prevents false matches on similar paths)
- Add Cache-Control: public, max-age=300 to /api/auth/config (values are static per deployment)
- Optimistic initial authConfig state so register toggle renders without layout shift
- Integration tests for /api/auth/config and registration block in [...all]/route (12 cases)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../api/auth/[...all]/__tests__/route.test.ts | 69 ++++++++++++++++
 web/src/app/api/auth/[...all]/route.ts        |  5 +-
 .../api/auth/config/__tests__/route.test.ts   | 80 +++++++++++++++++++
 web/src/app/api/auth/config/route.ts          | 13 +--
 web/src/app/login/page.tsx                    | 18 +++--
 5 files changed, 170 insertions(+), 15 deletions(-)
 create mode 100644 web/src/app/api/auth/[...all]/__tests__/route.test.ts
 create mode 100644 web/src/app/api/auth/config/__tests__/route.test.ts

diff --git a/web/src/app/api/auth/[...all]/__tests__/route.test.ts b/web/src/app/api/auth/[...all]/__tests__/route.test.ts
new file mode 100644
index 0000000..a1f878a
--- /dev/null
+++ b/web/src/app/api/auth/[...all]/__tests__/route.test.ts
@@ -0,0 +1,69 @@
+// Mock Better-Auth and the auth instance so the route can be imported without DB setup.
+jest.mock('@/lib/auth', () => ({ auth: {} }));
+jest.mock('better-auth/next-js', () => ({
+  toNextJsHandler: () => ({
+    GET: jest.fn().mockResolvedValue(new Response('ok', { status: 200 })),
+    POST: jest.fn().mockResolvedValue(new Response('ok', { status: 200 })),
+  }),
+}));
+
+import { NextRequest } from 'next/server';
+import { POST } from '../route';
+
+function makePost(pathname: string) {
+  return new NextRequest(`http://localhost${pathname}`, { method: 'POST' });
+}
+
+describe('POST /api/auth/[...all] — registration guard', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('blocks /sign-up/email with 403 when ALLOW_REGISTRATION=false', async () => {
+    process.env.ALLOW_REGISTRATION = 'false';
+
+    const res = await POST(makePost('/api/auth/sign-up/email'), undefined as never);
+
+    expect(res.status).toBe(403);
+    const body = await res.json();
+    expect(body.error).toBe('Registration is disabled');
+  });
+
+  it('passes through /sign-up/email when ALLOW_REGISTRATION is unset', async () => {
+    delete process.env.ALLOW_REGISTRATION;
+
+    const res = await POST(makePost('/api/auth/sign-up/email'), undefined as never);
+
+    expect(res.status).toBe(200);
+  });
+
+  it('passes through /sign-up/email when ALLOW_REGISTRATION=true', async () => {
+    process.env.ALLOW_REGISTRATION = 'true';
+
+    const res = await POST(makePost('/api/auth/sign-up/email'), undefined as never);
+
+    expect(res.status).toBe(200);
+  });
+
+  it('does not block /sign-in/email regardless of ALLOW_REGISTRATION', async () => {
+    process.env.ALLOW_REGISTRATION = 'false';
+
+    const res = await POST(makePost('/api/auth/sign-in/email'), undefined as never);
+
+    expect(res.status).toBe(200);
+  });
+
+  it('does not block paths that merely contain sign-up/email as a substring', async () => {
+    process.env.ALLOW_REGISTRATION = 'false';
+
+    const res = await POST(makePost('/api/auth/bulk-sign-up/email'), undefined as never);
+
+    expect(res.status).toBe(200);
+  });
+});
diff --git a/web/src/app/api/auth/[...all]/route.ts b/web/src/app/api/auth/[...all]/route.ts
index 3881e3a..bd8b541 100644
--- a/web/src/app/api/auth/[...all]/route.ts
+++ b/web/src/app/api/auth/[...all]/route.ts
@@ -6,9 +6,10 @@ const handlers = toNextJsHandler(auth);
 
 export const GET = handlers.GET;
 
-export async function POST(request: NextRequest) {
+// Next.js requires the context param for catch-all routes; Better-Auth routes by URL so we don't forward it.
+export async function POST(request: NextRequest, _context: { params: Promise<{ all: string[] }> }) {
   const url = new URL(request.url);
-  if (process.env.ALLOW_REGISTRATION === 'false' && url.pathname.endsWith('/sign-up/email')) {
+  if (process.env.ALLOW_REGISTRATION === 'false' && url.pathname === '/api/auth/sign-up/email') {
     return NextResponse.json({ error: 'Registration is disabled' }, { status: 403 });
   }
   return handlers.POST(request);
diff --git a/web/src/app/api/auth/config/__tests__/route.test.ts b/web/src/app/api/auth/config/__tests__/route.test.ts
new file mode 100644
index 0000000..99042bc
--- /dev/null
+++ b/web/src/app/api/auth/config/__tests__/route.test.ts
@@ -0,0 +1,80 @@
+import { GET } from '../route';
+
+describe('GET /api/auth/config', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  it('returns github=true when both GitHub secrets are set', async () => {
+    process.env.GITHUB_CLIENT_ID = 'id';
+    process.env.GITHUB_CLIENT_SECRET = 'secret';
+    delete process.env.GOOGLE_CLIENT_ID;
+    delete process.env.GOOGLE_CLIENT_SECRET;
+
+    const res = await GET();
+    const body = await res.json();
+
+    expect(body.github).toBe(true);
+    expect(body.google).toBe(false);
+  });
+
+  it('returns github=false when only client ID is set (no secret)', async () => {
+    process.env.GITHUB_CLIENT_ID = 'id';
+    delete process.env.GITHUB_CLIENT_SECRET;
+
+    const res = await GET();
+    const body = await res.json();
+
+    expect(body.github).toBe(false);
+  });
+
+  it('returns google=true when both Google secrets are set', async () => {
+    delete process.env.GITHUB_CLIENT_ID;
+    process.env.GOOGLE_CLIENT_ID = 'gid';
+    process.env.GOOGLE_CLIENT_SECRET = 'gsecret';
+
+    const res = await GET();
+    const body = await res.json();
+
+    expect(body.google).toBe(true);
+    expect(body.github).toBe(false);
+  });
+
+  it('registrationEnabled defaults to true when ALLOW_REGISTRATION is unset', async () => {
+    delete process.env.ALLOW_REGISTRATION;
+
+    const res = await GET();
+    const body = await res.json();
+
+    expect(body.registrationEnabled).toBe(true);
+  });
+
+  it('registrationEnabled is false when ALLOW_REGISTRATION=false', async () => {
+    process.env.ALLOW_REGISTRATION = 'false';
+
+    const res = await GET();
+    const body = await res.json();
+
+    expect(body.registrationEnabled).toBe(false);
+  });
+
+  it('registrationEnabled is true when ALLOW_REGISTRATION=true', async () => {
+    process.env.ALLOW_REGISTRATION = 'true';
+
+    const res = await GET();
+    const body = await res.json();
+
+    expect(body.registrationEnabled).toBe(true);
+  });
+
+  it('includes Cache-Control header', async () => {
+    const res = await GET();
+    expect(res.headers.get('Cache-Control')).toBe('public, max-age=300, stale-while-revalidate=60');
+  });
+});
diff --git a/web/src/app/api/auth/config/route.ts b/web/src/app/api/auth/config/route.ts
index ec9574a..4244f1a 100644
--- a/web/src/app/api/auth/config/route.ts
+++ b/web/src/app/api/auth/config/route.ts
@@ -1,9 +1,12 @@
 import { NextResponse } from 'next/server';
 
 export async function GET() {
-  return NextResponse.json({
-    github: !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET),
-    google: !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),
-    registrationEnabled: process.env.ALLOW_REGISTRATION !== 'false',
-  });
+  return NextResponse.json(
+    {
+      github: !!(process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET),
+      google: !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET),
+      registrationEnabled: process.env.ALLOW_REGISTRATION !== 'false',
+    },
+    { headers: { 'Cache-Control': 'public, max-age=300, stale-while-revalidate=60' } },
+  );
 }
diff --git a/web/src/app/login/page.tsx b/web/src/app/login/page.tsx
index 957ee4a..915715b 100644
--- a/web/src/app/login/page.tsx
+++ b/web/src/app/login/page.tsx
@@ -28,11 +28,13 @@ function LoginForm() {
       ? rawCallback
       : '/';
 
-  const [authConfig, setAuthConfig] = useState<{
-    github: boolean;
-    google: boolean;
-    registrationEnabled: boolean;
-  } | null>(null);
+  // Optimistic defaults: registration visible immediately (avoid layout shift on load),
+  // OAuth buttons hidden until confirmed (they can't be guessed server-side).
+  const [authConfig, setAuthConfig] = useState({
+    github: false,
+    google: false,
+    registrationEnabled: true,
+  });
   const [mode, setMode] = useState<'login' | 'register'>('login');
   const [email, setEmail] = useState('');
   const [password, setPassword] = useState('');
@@ -47,7 +49,7 @@ function LoginForm() {
         setAuthConfig(cfg);
         if (!cfg.registrationEnabled) setMode('login');
       })
-      .catch(() => setAuthConfig({ github: false, google: false, registrationEnabled: true }));
+      .catch(() => {/* keep optimistic defaults on network error */});
   }, []);
 
   const handleCredentialsLogin = useCallback(
@@ -210,7 +212,7 @@ function LoginForm() {
           </Button>
         </Box>
 
-        {authConfig?.registrationEnabled && (
+        {authConfig.registrationEnabled && (
           <Button
             variant="text"
             size="small"
@@ -224,7 +226,7 @@ function LoginForm() {
           </Button>
         )}
 
-        {(authConfig?.github || authConfig?.google) && (
+        {(authConfig.github || authConfig.google) && (
           <>
             <Divider sx={{ width: '100%' }}>
               <Typography variant="body2" color="text.secondary">

From 8ad9d896fa3e31dc7cd06308ec9190539d6a0eac Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 22 May 2026 17:35:10 +0300
Subject: [PATCH 3/3] =?UTF-8?q?fix(auth):=20address=20Copilot=20review=20?=
 =?UTF-8?q?=E2=80=94=20fetch=20guard,=20error=20key,=20env=20comment=20pla?=
 =?UTF-8?q?cement?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Check r.ok before r.json() in config fetch; coerce fields to booleans so a
  non-2xx JSON error body can't corrupt authConfig state
- Add mounted flag to config useEffect to prevent state update after unmount
- Use message field (not error) in 403 response so handleRegister surfaces
  the real reason to the user via data.message
- Move inline comments to their own lines in .env.example — trailing inline
  comments on assignment lines are treated as part of the value by some
  env parsers (dotenv, Docker Compose), causing non-empty CLIENT_ID values

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .env.example                                     |  9 ++++++---
 .../api/auth/[...all]/__tests__/route.test.ts    |  2 +-
 web/src/app/api/auth/[...all]/route.ts           |  2 +-
 web/src/app/login/page.tsx                       | 16 ++++++++++++++--
 4 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/.env.example b/.env.example
index b7fa474..017368e 100644
--- a/.env.example
+++ b/.env.example
@@ -116,11 +116,14 @@ CACHE_DIR=/app/data/cache
 BETTER_AUTH_URL=http://localhost:3000    # Public URL of the web app (used for cookie security + trusted origins)
 FRONTEND_URL=                            # Set if different from BETTER_AUTH_URL (e.g. custom domain)
 AUTH_SECRET=change-me-in-development
-GITHUB_CLIENT_ID=                       # Leave blank to hide "Sign in with GitHub"
+# Leave blank to hide "Sign in with GitHub"
+GITHUB_CLIENT_ID=
 GITHUB_CLIENT_SECRET=
-GOOGLE_CLIENT_ID=                       # Leave blank to hide "Sign in with Google"
+# Leave blank to hide "Sign in with Google"
+GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=
-ALLOW_REGISTRATION=true                 # Set to false to disable self-service account creation
+# Set to false to disable self-service account creation
+ALLOW_REGISTRATION=true
 
 # RS256 JWT keys (cross-service auth: app → backend)
 # Generate with:
diff --git a/web/src/app/api/auth/[...all]/__tests__/route.test.ts b/web/src/app/api/auth/[...all]/__tests__/route.test.ts
index a1f878a..890c5d6 100644
--- a/web/src/app/api/auth/[...all]/__tests__/route.test.ts
+++ b/web/src/app/api/auth/[...all]/__tests__/route.test.ts
@@ -32,7 +32,7 @@ describe('POST /api/auth/[...all] — registration guard', () => {
 
     expect(res.status).toBe(403);
     const body = await res.json();
-    expect(body.error).toBe('Registration is disabled');
+    expect(body.message).toBe('Registration is disabled');
   });
 
   it('passes through /sign-up/email when ALLOW_REGISTRATION is unset', async () => {
diff --git a/web/src/app/api/auth/[...all]/route.ts b/web/src/app/api/auth/[...all]/route.ts
index bd8b541..3cb2781 100644
--- a/web/src/app/api/auth/[...all]/route.ts
+++ b/web/src/app/api/auth/[...all]/route.ts
@@ -10,7 +10,7 @@ export const GET = handlers.GET;
 export async function POST(request: NextRequest, _context: { params: Promise<{ all: string[] }> }) {
   const url = new URL(request.url);
   if (process.env.ALLOW_REGISTRATION === 'false' && url.pathname === '/api/auth/sign-up/email') {
-    return NextResponse.json({ error: 'Registration is disabled' }, { status: 403 });
+    return NextResponse.json({ message: 'Registration is disabled' }, { status: 403 });
   }
   return handlers.POST(request);
 }
diff --git a/web/src/app/login/page.tsx b/web/src/app/login/page.tsx
index 915715b..67ed1d3 100644
--- a/web/src/app/login/page.tsx
+++ b/web/src/app/login/page.tsx
@@ -43,13 +43,25 @@ function LoginForm() {
   const [loading, setLoading] = useState(false);
 
   useEffect(() => {
+    let mounted = true;
     fetch('/api/auth/config')
-      .then((r) => r.json())
+      .then((r) => {
+        if (!r.ok) return undefined;
+        return r.json();
+      })
       .then((cfg) => {
-        setAuthConfig(cfg);
+        if (!mounted || !cfg) return;
+        setAuthConfig({
+          github: !!cfg.github,
+          google: !!cfg.google,
+          registrationEnabled: cfg.registrationEnabled !== false,
+        });
         if (!cfg.registrationEnabled) setMode('login');
       })
       .catch(() => {/* keep optimistic defaults on network error */});
+    return () => {
+      mounted = false;
+    };
   }, []);
 
   const handleCredentialsLogin = useCallback(