From 9bebc9e92d0a056395f44672303bf982fdeb989b Mon Sep 17 00:00:00 2001
From: Denozordec <shatskiy.blog@gmail.com>
Date: Tue, 4 Aug 2026 18:58:17 +0700
Subject: [PATCH] Refactor JWT secret handling in loadConfig function to ensure
 proper validation and trimming. Added error handling for production
 environment requiring a minimum length for JWT_SECRET.

---
 apps/api/src/config.ts | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/apps/api/src/config.ts b/apps/api/src/config.ts
index a7c38c1..bb2f7b4 100644
--- a/apps/api/src/config.ts
+++ b/apps/api/src/config.ts
@@ -23,7 +23,19 @@ export type AppConfig = z.infer<typeof configSchema>
 
 export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
   const isProd = env.NODE_ENV === 'production'
-  const jwtSecret = env.JWT_SECRET ?? (isProd ? '' : 'dev-secret-change-me')
+  const jwtFromEnv = env.JWT_SECRET?.trim()
+  const jwtSecret =
+    jwtFromEnv && jwtFromEnv.length > 0
+      ? jwtFromEnv
+      : isProd
+        ? ''
+        : 'dev-secret-change-me'
+
+  if (isProd && jwtSecret.length < 8) {
+    throw new Error(
+      'JWT_SECRET is required in production and must be at least 8 characters (e.g. openssl rand -hex 32)',
+    )
+  }
 
   return configSchema.parse({
     databaseUrl: env.DATABASE_URL ?? 'sqlite:data/app.db',