feat: support OAuth login on preview deployments

[devhims]

Problem / Motivation

Google accepts a fixed OAuth callback. Vercel preview URLs change for each deployment, so users cannot sign in to an authenticated preview.

Why it matters

Auth-gated changes cannot be tested in a real preview before they reach production.

What changed

Better Auth now accepts this Vercel project's preview hosts and uses its OAuth proxy plugin. Google still returns to the registered production callback. The backend encrypts the short-lived handoff and sends the user back to the preview, where Better Auth creates the session.

The preview uses the same Google client and production backend. OAUTH_PROXY_SECRET is separate from BETTER_AUTH_SECRET, and proxy payloads expire after 60 seconds. Origins outside all-things-youtube-web-*.vercel.app remain blocked.

flowchart LR
  subgraph Before
    P1[preview login]:::ctx --> G1[Google]:::removed --> X1[dynamic callback rejected]:::removed
  end
  subgraph After
    P2[preview login]:::ctx --> O[OAuth proxy]:::added --> G2[Google]:::ctx --> C[production callback]:::changed --> P3[preview session]:::added
  end
  classDef added fill:#DCFCE7,stroke:#16A34A,color:#14532D,stroke-width:2px
  classDef changed fill:#FEF3C7,stroke:#D97706,color:#78350F,stroke-width:2px
  classDef removed fill:#FEE2E2,stroke:#DC2626,color:#7F1D1D,stroke-dasharray:4 3
  classDef ctx fill:#E0F2FE,stroke:#0284C7,color:#0C4A6E
  linkStyle 0,1 stroke:#DC2626,stroke-dasharray:4 3
  linkStyle 2,3,4,5 stroke:#16A34A,stroke-width:2px

Loading

🟩 added · 🟨 changed · 🟥 removed · 🟦 unchanged

The preview now returns through the fixed production callback and receives its own session.

Tests

• npm --prefix platform run build
• npx vitest run test/auth-config.test.ts
• npm --prefix platform run test:auth:integration -- test/auth-worker.integration.test.ts
• The integration test confirms that an approved preview gets the production Google callback and encrypted proxy state.
• The integration test confirms that an unrelated Vercel origin gets a 403.

Manual verification

Deploy this branch to Vercel and the Worker, then complete Google sign-in from the preview URL. The external Google round trip cannot run in the local test Worker.

Screenshots / video

Not applicable. This changes authentication routing without changing rendered UI.

Issue link

no linked issue: requested directly during development.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
video2ctx-web	Ready	Preview	Sep 20, 2026 3:17pm UTC

[devhims]

Intent: Let approved Vercel previews complete Google OAuth through the fixed production callback while using the existing production backend and client.
Not a goal: Share production cookies, trust unrelated Vercel projects, or change the rendered login interface.