feat(auth): replace Google login with credentials

lib/auth/authorization.test.ts

@@ -1,6 +1,10 @@
 import { describe, expect, it } from "vitest";
 
-import { isAuthorizedAdmin } from "./authorization";
+import {
+  isAllowedAdminRegistration,
+  isAuthorizedAdmin,
+  isConfiguredAdminEmail,
+} from "./authorization";
 
 const verified = {
   id: "admin",
@@ -9,6 +13,36 @@ const verified = {
 };
 
 describe("admin authorization", () => {
+  it("recognizes only the exact configured administrator email", () => {
+    expect(isConfiguredAdminEmail(verified.email, "[email protected]")).toBe(
+      true,
+    );
+    expect(isConfiguredAdminEmail(verified.email, "[email protected]")).toBe(
+      false,
+    );
+    expect(isConfiguredAdminEmail(verified.email, undefined)).toBe(false);
+  });
+
+  it("allows only credential registration for the configured administrator", () => {
+    expect(
+      isAllowedAdminRegistration(
+        verified.email,
+        "email-password",
+        verified.email,
+      ),
+    ).toBe(true);
+    expect(
+      isAllowedAdminRegistration(
+        "[email protected]",
+        "email-password",
+        verified.email,
+      ),
+    ).toBe(false);
+    expect(
+      isAllowedAdminRegistration(verified.email, "oauth", verified.email),
+    ).toBe(false);
+  });
+
   it("requires an exact verified email match", () => {
     expect(isAuthorizedAdmin(verified, "[email protected]")).toBe(true);
     expect(isAuthorizedAdmin(verified, "[email protected]")).toBe(false);

lib/auth/authorization.ts

@@ -6,6 +6,24 @@ export interface SessionUserLike {
   image?: string | null;
 }
 
+export function isConfiguredAdminEmail(
+  email: string | null | undefined,
+  adminEmail: string | null | undefined,
+): boolean {
+  return Boolean(email && adminEmail && email === adminEmail);
+}
+
+export function isAllowedAdminRegistration(
+  email: string | null | undefined,
+  authMethod: string,
+  adminEmail: string | null | undefined,
+): boolean {
+  return (
+    authMethod === "email-password" &&
+    isConfiguredAdminEmail(email, adminEmail)
+  );
+}
+
 export function isAuthorizedAdmin(
   user: SessionUserLike | null | undefined,
   adminEmail: string | null | undefined,
@@ -13,7 +31,6 @@ export function isAuthorizedAdmin(
   return Boolean(
     user &&
       user.emailVerified === true &&
-      adminEmail &&
-      user.email === adminEmail,
+      isConfiguredAdminEmail(user.email, adminEmail),
   );
 }

lib/auth/server.ts

@@ -13,7 +13,12 @@ import {
   verifications,
 } from "@/db/schema";
 
-import { isAuthorizedAdmin, type SessionUserLike } from "./authorization";
+import {
+  isAllowedAdminRegistration,
+  isAuthorizedAdmin,
+  isConfiguredAdminEmail,
+  type SessionUserLike,
+} from "./authorization";
 
 function required(name: string): string {
   const value = process.env[name];
@@ -22,6 +27,8 @@ function required(name: string): string {
 }
 
 function createAuth() {
+  const adminEmail = required("ADMIN_EMAIL");
+
   return betterAuth({
     appName: "Buzz Sheet",
     database: drizzleAdapter(getDb(), {
@@ -36,10 +43,36 @@ function createAuth() {
     }),
     baseURL: required("BETTER_AUTH_URL"),
     secret: required("BETTER_AUTH_SECRET"),
-    socialProviders: {
-      google: {
-        clientId: required("GOOGLE_CLIENT_ID"),
-        clientSecret: required("GOOGLE_CLIENT_SECRET"),
+    emailAndPassword: {
+      enabled: true,
+      minPasswordLength: 8,
+      maxPasswordLength: 128,
+    },
+    user: {
+      validateUserInfo: async ({ user, source }) => {
+        if (
+          !isAllowedAdminRegistration(
+            user.email,
+            source.method,
+            adminEmail,
+          )
+        ) {
+          return {
+            error: "ADMIN_REGISTRATION_FORBIDDEN",
+            errorDescription:
+              "Registration is limited to the configured administrator.",
+          };
+        }
+      },
+    },
+    databaseHooks: {
+      user: {
+        create: {
+          before: async (user) => {
+            if (!isConfiguredAdminEmail(user.email, adminEmail)) return false;
+            return { data: { emailVerified: true } };
+          },
+        },
       },
     },
     plugins: [nextCookies()],