@@ -0,0 +1,14 @@
+---
+'@objectstack/service-settings': patch
+---
+
+fix(service-settings): Setup → Authentication says what the sign-up and Google toggles do beside the audience and the credentials (#24776)
+
+Clause-②: no
+
+Two controls on the Authentication settings page read as contradicting the system on a fresh install. Their wording changes; no default, `visible` rule, `required` flag, option or stored key moves, and no deployment admits or signs in anyone it did not before.
+
+- **`auth.signup_enabled`** is now labelled *Allow email sign-up* (it was *Allow self-service registration*) and carries help text. It is the email-and-password sign-up form's own switch, and the *Self-registration audience* decides who the form admits: under `invite_only`, only an address holding a pending invitation; under `email_domain`, the allowlisted domains and invited addresses; under `open`, anyone. Off closes the form under every audience, invitations included. So ON beside *Invitation only* means the form is open to invited addresses.
+- **`auth.google_enabled`** help now says that Google sign-in is offered only once a client ID and a client secret both resolve, saved on the page or set as `GOOGLE_CLIENT_ID` and `GOOGLE_CLIENT_SECRET` on the server (which win over saved values). Until then the login page shows no Google button, even while the toggle is on. Off withdraws Google sign-in even when the server sets both.
+
+The English, Chinese, Japanese and Spanish bundles carry the new label and help.
@@ -3,6 +3,7 @@
 import { describe, it, expect } from 'vitest';
 import { SettingsManifestSchema } from '@objectstack/spec/system';
 import { SettingsService } from '../settings-service.js';
+import { en } from '../translations/index.js';
 import { authSettingsManifest } from './auth.manifest.js';
 
 describe('authSettingsManifest', () => {
@@ -221,4 +222,62 @@ describe('authSettingsManifest', () => {
     await expect(svc.setMany('auth', { audience_posture: 'email_domain' })).resolves.toBeDefined();
     expect((await svc.get('auth', 'audience_posture')).value).toBe('email_domain');
   });
+
+  // The sign-up toggle and the audience posture are two doors in series on the
+  // email/password sign-up route: plugin-auth binds `signup_enabled` to
+  // `emailAndPassword.disableSignUp` and the posture to the audience gate, and
+  // a registrant passes only when both admit. ON beside "Invitation only"
+  // therefore means "the form is open to invited addresses", which the page
+  // must say rather than leave reading as a contradiction.
+  it('signup_enabled states its conjunction with every audience posture, and stays a door of its own', () => {
+    const specs = authSettingsManifest.specifiers as any[];
+    const signup = specs.find((s) => s.key === 'signup_enabled');
+    const posture = specs.find((s) => s.key === 'audience_posture');
+
+    // The runtime's own default: no explicit value leaves `disableSignUp`
+    // unset, so the route is open.
+    expect(signup.default).toBe(true);
+    // Never hidden behind the posture: under `invite_only` it still decides
+    // whether an invited address may register through the form, so a value
+    // hidden there would close or open that door out of the admin's sight.
+    expect(signup.visible).toBe('${data.email_password_enabled !== false}');
+
+    // The help names every posture the select declares, read from the option
+    // table, so a posture added later reds here until the help covers it.
+    expect(typeof signup.description).toBe('string');
+    for (const value of posture.options.map((o: any) => o.value)) {
+      expect(signup.description, `signup_enabled help names posture ${value}`).toContain(value);
+    }
+    expect(signup.description).toContain(posture.label);
+  });
+
+  // plugin-auth registers Google only when the toggle is on AND a client ID and
+  // secret both resolve, from the stored keys or from GOOGLE_CLIENT_ID /
+  // GOOGLE_CLIENT_SECRET, which the settings service cannot see. The page can
+  // only say so; the help is where it does.
+  it('google_enabled keeps the runtime default and names the env credentials that complete it', () => {
+    const specs = authSettingsManifest.specifiers as any[];
+    const google = specs.find((s) => s.key === 'google_enabled');
+
+    // `true` is what the runtime assumes for an undeclared toggle; a `false`
+    // default would read OFF on a deployment that signs in with Google through
+    // the env credentials, and hide its stored credentials behind `visible`.
+    expect(google.default).toBe(true);
+    expect(google.description).toContain('GOOGLE_CLIENT_ID');
+    expect(google.description).toContain('GOOGLE_CLIENT_SECRET');
+  });
+
+  // The console resolves `settings.auth.keys.<key>.label` / `.help` from the
+  // served bundle BEFORE the manifest literal, in every locale, English
+  // included. An `en` entry that lags the manifest therefore shadows it: the
+  // corrected text never reaches an English admin.
+  it('the en bundle carries the manifest label and help verbatim for the sign-up and Google toggles', () => {
+    const specs = authSettingsManifest.specifiers as any[];
+    const keys = (en.settings as any).auth.keys;
+    for (const key of ['signup_enabled', 'google_enabled']) {
+      const spec = specs.find((s) => s.key === key);
+      expect(keys[key].label, `${key} label`).toBe(spec.label);
+      expect(keys[key].help, `${key} help`).toBe(spec.description);
+    }
+  });
 });
@@ -30,12 +30,22 @@ const manifest = {
       required: false,
       default: true,
     },
+    // The email/password sign-up route's own switch (`emailAndPassword.
+    // disableSignUp`), a door of its own beside the audience posture below:
+    // the route admits a registrant only when BOTH say yes. So it is not
+    // hidden under `invite_only` — there it still decides whether an invited
+    // address may register through the form — and its default stays `true`,
+    // the runtime's own default (`disableSignUp` unset ⇒ open). The help text
+    // states the conjunction, so ON beside "Invitation only" reads as what it
+    // is rather than as a contradiction.
     {
       type: 'toggle',
       key: 'signup_enabled',
-      label: 'Allow self-service registration',
+      label: 'Allow email sign-up',
       required: false,
       default: true,
+      description:
+        'Opens the email-and-password sign-up form. Who it admits is decided by the Self-registration audience below: under invite_only, only an address holding a pending invitation; under email_domain, the allowlisted domains and invited addresses; under open, anyone. Off closes the form under every audience, invitations included.',
       visible: "${data.email_password_enabled !== false}",
     },
     {
@@ -426,14 +436,20 @@ const manifest = {
       description:
         'Configure the built-in Google sign-in provider. Deployment env vars still win.',
     },
+    // Google is offered only when this is on AND a client ID and secret both
+    // resolve (saved here, or GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET, which
+    // the settings service cannot see). The default stays `true` because that
+    // is the runtime's own default for an undeclared toggle, and a deployment
+    // signing in with env credentials relies on it; the help text carries the
+    // conjunction, so ON beside two empty fields reads as "not offered yet".
     {
       type: 'toggle',
       key: 'google_enabled',
       label: 'Enable Google login',
       required: false,
       default: true,
       description:
-        'Requires a Google OAuth client ID and secret from Google Cloud Console.',
+        'Offers Google sign-in once a client ID and a client secret both resolve: saved below, or GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on the server, which win over saved values. Until both resolve, the login page shows no Google button, even while this is on. Off withdraws Google sign-in even when the server sets both. Create the OAuth client in Google Cloud Console.',
     },
     {
       type: 'text',
 
@@ -154,7 +154,10 @@ export const en: PlatformTranslationData = {
       },
       keys: {
         email_password_enabled: { label: 'Enable email/password login' },
-        signup_enabled: { label: 'Allow self-service registration' },
+        signup_enabled: {
+          label: 'Allow email sign-up',
+          help: 'Opens the email-and-password sign-up form. Who it admits is decided by the Self-registration audience below: under invite_only, only an address holding a pending invitation; under email_domain, the allowlisted domains and invited addresses; under open, anyone. Off closes the form under every audience, invitations included.',
+        },
         require_email_verification: { label: 'Require email verification' },
         membership_policy: {
           label: 'New user membership',
@@ -187,7 +190,7 @@ export const en: PlatformTranslationData = {
         session_refresh_days: { label: 'Refresh threshold (days)', help: 'An active session is extended when it is older than this.' },
         google_enabled: {
           label: 'Enable Google login',
-          help: 'Requires a Google OAuth client ID and secret from Google Cloud Console.',
+          help: 'Offers Google sign-in once a client ID and a client secret both resolve: saved below, or GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on the server, which win over saved values. Until both resolve, the login page shows no Google button, even while this is on. Off withdraws Google sign-in even when the server sets both. Create the OAuth client in Google Cloud Console.',
         },
         google_client_id: {
           label: 'Google client ID',
 
@@ -125,7 +125,10 @@ export const esES: PlatformTranslationData = {
       },
       keys: {
         email_password_enabled: { label: 'Habilitar inicio de sesión con correo/contraseña' },
-        signup_enabled: { label: 'Permitir registro de autoservicio' },
+        signup_enabled: {
+          label: 'Permitir el registro por correo',
+          help: 'Abre el formulario de registro con correo y contraseña. A quién admite lo decide la «Audiencia de autorregistro» inferior: con «Solo por invitación», solo a una dirección con una invitación pendiente; con «Dominios de correo», a los dominios de la lista y a las direcciones invitadas; con «Abierto», a cualquiera. Desactivado, cierra el formulario con cualquier audiencia, invitaciones incluidas.',
+        },
         require_email_verification: { label: 'Requerir verificación de correo' },
         membership_policy: {
           label: 'Pertenencia de los usuarios nuevos',
@@ -234,7 +237,7 @@ export const esES: PlatformTranslationData = {
         },
         google_enabled: {
           label: 'Habilitar inicio de sesión con Google',
-          help: 'Requiere un ID de cliente y un secreto de OAuth de Google desde Google Cloud Console.',
+          help: 'Ofrece el inicio de sesión con Google cuando se resuelven tanto un ID de cliente como un secreto de cliente: los guardados abajo, o GOOGLE_CLIENT_ID y GOOGLE_CLIENT_SECRET en el servidor, que tienen prioridad sobre los valores guardados. Hasta que ambos se resuelvan, la página de inicio de sesión no muestra el botón de Google, aunque esta opción esté activada. Desactivada, retira el inicio de sesión con Google aunque el servidor defina ambos. Crea el cliente OAuth en Google Cloud Console.',
         },
         google_client_id: {
           label: 'ID de cliente de Google',
 
@@ -125,7 +125,10 @@ export const jaJP: PlatformTranslationData = {
       },
       keys: {
         email_password_enabled: { label: 'メール/パスワードログインを有効化' },
-        signup_enabled: { label: 'セルフサービス登録を許可' },
+        signup_enabled: {
+          label: 'メールでの新規登録を許可',
+          help: 'メールとパスワードによる新規登録フォームを開きます。誰を受け入れるかは下の「セルフ登録の対象」が決めます。「招待のみ」では保留中の招待を持つアドレスのみ、「メールドメイン」では許可リストのドメインと招待済みのアドレス、「オープン」では誰でも受け入れます。オフにすると、どの対象でもフォームが閉じ、招待済みのアドレスも登録できません。',
+        },
         require_email_verification: { label: 'メール確認を必須にする' },
         membership_policy: {
           label: '新規ユーザーのメンバーシップ',
@@ -234,7 +237,7 @@ export const jaJP: PlatformTranslationData = {
         },
         google_enabled: {
           label: 'Google ログインを有効化',
-          help: 'Google Cloud Console の Google OAuth クライアント ID とシークレットが必要です。',
+          help: 'クライアント ID とクライアントシークレットの両方が解決されると Google サインインを提供します。値は下に保存したもの、またはサーバーの GOOGLE_CLIENT_ID と GOOGLE_CLIENT_SECRET(保存した値より優先)から解決されます。両方が解決されるまでは、オンでもログインページに Google ボタンは表示されません。オフにすると、サーバーが両方を設定していても Google サインインを取り下げます。OAuth クライアントは Google Cloud Console で作成してください。',
         },
         google_client_id: {
           label: 'Google クライアント ID',
 
@@ -267,7 +267,10 @@ export const zhCN: PlatformTranslationData = {
       },
       keys: {
         email_password_enabled: { label: '启用邮箱/密码登录' },
-        signup_enabled: { label: '允许自助注册' },
+        signup_enabled: {
+          label: '允许邮箱注册',
+          help: '开启邮箱与密码注册表单。它接纳谁由下方的「自助注册受众」决定:「仅限邀请」下只接纳持有待处理邀请的地址;「邮箱域名」下接纳允许列表中的域名与受邀地址;「开放」下接纳任何人。关闭后,在任何受众下该表单都会关闭,受邀者也不例外。',
+        },
         require_email_verification: { label: '要求邮箱验证' },
         membership_policy: {
           label: '新用户的成员归属',
@@ -376,7 +379,7 @@ export const zhCN: PlatformTranslationData = {
         },
         google_enabled: {
           label: '启用 Google 登录',
-          help: '需要在 Google Cloud Console 中创建的 Google OAuth 客户端 ID 与密钥。',
+          help: '客户端 ID 与客户端密钥都能解析时才提供 Google 登录:来自下方保存的值,或服务器上的 GOOGLE_CLIENT_ID 与 GOOGLE_CLIENT_SECRET(优先于保存的值)。两者都能解析之前,即使此开关已开启,登录页也不显示 Google 按钮。关闭后,即使服务器设置了两者,也会撤下 Google 登录。请在 Google Cloud Console 中创建 OAuth 客户端。',
         },
         google_client_id: {
           label: 'Google 客户端 ID',