fix(auth) : pause Sudloh sign-in for local login

lib/auth/server.test.ts

@@ -11,7 +11,7 @@ vi.mock("better-auth/plugins", () => ({ admin: (options: unknown) => options, ca
   genericOAuth: (options: unknown) => ({ id: "generic-oauth", options }),
   emailOTP: (options: unknown) => ({ id: "email-otp", options }) }));
 
-const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY", "TRUSTED_CLIENT_IP_HEADER"] as const;
+const envNames = ["NODE_ENV", "DATABASE_URL", "BETTER_AUTH_URL", "BETTER_AUTH_SECRET", "BUZZ_DEMO_MODE", "RESEND_API_KEY", "SUDLOH_OIDC_CLIENT_ID", "SUDLOH_OIDC_CLIENT_SECRET", "SUDLOH_OIDC_REDIRECT_URI", "SUDLOH_OIDC_ISSUER", "SUDLOH_OIDC_ONLY", "SUDLOH_OIDC_PAUSED", "TRUSTED_CLIENT_IP_HEADER"] as const;
 const testEnv = process.env as Record<string, string | undefined>;
 const originalEnv = envNames.map((name) => testEnv[name]);
 
@@ -28,6 +28,7 @@ beforeEach(() => {
   delete testEnv.SUDLOH_OIDC_REDIRECT_URI;
   delete testEnv.SUDLOH_OIDC_ISSUER;
   delete testEnv.SUDLOH_OIDC_ONLY;
+  delete testEnv.SUDLOH_OIDC_PAUSED;
   delete testEnv.TRUSTED_CLIENT_IP_HEADER;
 });
 afterEach(() => {
@@ -83,6 +84,18 @@ describe("actual administrator session boundary", () => {
       redirectURI: "https://guide.example.test/api/auth/callback/sudloh",
     });
   });
+  it("uses local sign-in while Sudloh is paused, even with client credentials present", async () => {
+    testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
+    testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";
+    testEnv.SUDLOH_OIDC_REDIRECT_URI = "https://guide.example.test/api/auth/callback/sudloh";
+    testEnv.SUDLOH_OIDC_PAUSED = "true";
+    const { getAuth, isSudlohOidcEnabled } = await import("./server");
+    expect(isSudlohOidcEnabled()).toBe(false);
+    getAuth();
+    const options = mocks.auth.mock.calls.at(-1)![0];
+    expect(options.emailAndPassword).toMatchObject({ enabled: true, disableSignUp: false });
+    expect(options.plugins.some((plugin: { id?: string }) => plugin.id === "generic-oauth")).toBe(false);
+  });
   it("disables local sign-in after the OIDC cutover flag is set", async () => {
     testEnv.SUDLOH_OIDC_CLIENT_ID = "client";
     testEnv.SUDLOH_OIDC_CLIENT_SECRET = "secret";

lib/auth/server.ts

@@ -33,6 +33,7 @@ function hasAuthConfiguration(): boolean {
 }
 
 export function isSudlohOidcEnabled(): boolean {
+  if (process.env.SUDLOH_OIDC_PAUSED === "true") return false;
   const clientId = process.env.SUDLOH_OIDC_CLIENT_ID;
   const clientSecret = process.env.SUDLOH_OIDC_CLIENT_SECRET;
   if (!clientId && !clientSecret) return false;