From 410bd2de1fe55fd753b30f89d76320a914740aa3 Mon Sep 17 00:00:00 2001 From: ht Date: Sun, 6 Sep 2026 17:33:35 +0300 Subject: [PATCH] require auth secret in production --- server/auth.mjs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/server/auth.mjs b/server/auth.mjs index 12c01a7..c8de651 100644 --- a/server/auth.mjs +++ b/server/auth.mjs @@ -10,8 +10,12 @@ import crypto from 'node:crypto'; import https from 'node:https'; const CLIENT_ID = () => process.env.GOOGLE_CLIENT_ID || null; -const AUTH_SECRET = () => - process.env.AUTH_SECRET || process.env.GOOGLE_CLIENT_ID || 'ihaleist-dev-secret'; +const AUTH_SECRET = () => { + const configured = process.env.AUTH_SECRET || process.env.GOOGLE_CLIENT_ID; + if (configured) return configured; + if (process.env.NODE_ENV === 'production') throw new Error('Üretimde AUTH_SECRET zorunludur.'); + return 'ihaleist-dev-secret'; +}; const TOKEN_TTL_SEC = 30 * 24 * 60 * 60; // 30 gün export function adminEmails() {