oauth hidden

components/auth/oauth-buttons.tsx

@@ -17,6 +17,12 @@ import { useMemo } from "react";
 const BFF_BASE =
   process.env.NEXT_PUBLIC_BFF_URL || "http://localhost:8080";
 
+// Build-time switch — keep the buttons hidden until the Google + Facebook
+// OAuth apps clear review. Flip `NEXT_PUBLIC_OAUTH_ENABLED=true` on the
+// Next.js build (Vercel/Dokploy env vars) once approval lands; no code
+// change required. Defaults to disabled so prod stays safe by default.
+const OAUTH_ENABLED = process.env.NEXT_PUBLIC_OAUTH_ENABLED === "true";
+
 type Props = {
   /** Frontend path to land on after the round-trip. Defaults to /u/me. */
   next?: string;
@@ -25,6 +31,9 @@ type Props = {
 };
 
 export function OAuthButtons({ next, showDivider = true }: Props) {
+  // Suppress the whole row (no buttons → no "or" divider either) while
+  // the OAuth apps are under review.
+  if (!OAUTH_ENABLED) return null;
   const startUrl = useMemo(
     () => (provider: "google" | "facebook") => {
       const u = new URL(`${BFF_BASE}/api/v1/auth/oauth/${provider}/start`);