Refactor JWT secret handling in loadConfig function to ensure proper validation and trimming. Added error handling for production environment requiring a minimum length for JWT_SECRET.

2026-08-04 18:58:17 +07:00
parent 06262664d2
commit 9bebc9e92d
1 changed files with 13 additions and 1 deletions
@@ -23,7 +23,19 @@ export type AppConfig = z.infer<typeof configSchema>

 export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
  const isProd = env.NODE_ENV === 'production'
-  const jwtSecret = env.JWT_SECRET ?? (isProd ? '' : 'dev-secret-change-me')
+  const jwtFromEnv = env.JWT_SECRET?.trim()
+  const jwtSecret =
+    jwtFromEnv && jwtFromEnv.length > 0
+      ? jwtFromEnv
+      : isProd
+        ? ''
+        : 'dev-secret-change-me'
+
+  if (isProd && jwtSecret.length < 8) {
+    throw new Error(
+      'JWT_SECRET is required in production and must be at least 8 characters (e.g. openssl rand -hex 32)',
+    )
+  }

  return configSchema.parse({
    databaseUrl: env.DATABASE_URL ?? 'sqlite:data/app.db',