feat(web): enable Continue with Google auth buttons

[onerandomdevv]

What does this PR do?

Enables the web auth entry points for backend Google OAuth now that backend Google OAuth and the pending Google onboarding completion page are available.

Type of change

• New feature
• Bug fix
• Refactor / cleanup
• Database migration included
• Chore / maintenance
• Documentation

Area affected

• Backend
• Web
• WhatsApp
• Shared package
• Database / Prisma
• GitHub / CI / infrastructure

How to test this

1. Visit /login and click Continue with Google.
2. Confirm the browser is sent to the backend OAuth start URL: /auth/google?redirect=/home or the safe
   edirect query path.
3. Visit /register and click Continue with Google.
4. Confirm the browser is sent to /auth/google?redirect=/explore or the safe
   edirect query path.
5. Visit either page with a backend ?error= value and confirm a clean Google auth error message is shown.

Pre-commit checklist

• Backend lint/type/build pass when backend is affected
• Web lint/type/build pass when web is affected
• Shared package build passes when shared is affected
• No console.log left in production code
• No secrets or .env files committed
• No new �ny types added
• No non-MVP legacy features reintroduced
• All money values are BigInt kobo, never float
• Paystack webhook changes verify HMAC before processing
• Database migrations are Prisma migrations, not db push
• Database migrations are backward-compatible or risk is documented

Screenshots

N/A - focused auth button wiring, no visual redesign.

Notes for reviewer

Pages changed:

• /login
• /register

Google OAuth URL behavior:

• Adds a shared helper that builds ${NEXT_PUBLIC_API_URL}/auth/google?redirect=.
• Web does not require or expose a Google client ID.
• Backend remains responsible for OAuth, callback handling, and HttpOnly auth cookies.

Redirect handling:

• Login defaults to /home.
• Register defaults to /explore.
• Same-site path redirects are preserved when safe.
• Auth routes and unsafe external/protocol-relative redirects fall back to the page default.

Error handling:

• Maps backend ?error= query values to clean messages for failed Google sign-in, unverified Google email, expired Google sessions, and generic auth failures.

Product confirmations:

• Google copy says Google verifies email only.
• Copy says phone verification may still be required before checkout.
• New Google users still flow through /register/google/complete from the backend callback.

Excluded:

• No backend changes.
• No schema changes.
• No Google completion page changes.
• No phone verification flow changes.
• No username/displayName profile step.
• No Neon Auth.

Validation:

• cd apps/web && pnpm.cmd run lint passed.
• cd apps/web && pnpm.cmd run build passed.
• cd apps/web && npx.cmd tsc --noEmit passed after build regenerated .next/types.
• Initial parallel typecheck failed because
  ext build was regenerating .next/types at the same time; rerun passed.
• git diff --check passed.
• git diff --cached --check passed.
• Staged secret scan passed.
• Staged forbidden visible-term scan passed for escrow, merchant, OTP, platform fee, and commission.
• Pre-commit hook passed ESLint, security sentinel, and Prettier for staged web files.

[codesandbox]

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
twizrr-web	Ready	Preview, Comment	Jun 8, 2026 5:50pm