From d9b6e11582942ed7a9ca0c11bff1b0f295f6fbd7 Mon Sep 17 00:00:00 2001
From: ht <hikmet@texmart.com>
Date: Sun, 6 Sep 2026 17:34:13 +0300
Subject: [PATCH] fail closed on missing auth secret

---
 server/auth.mjs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server/auth.mjs b/server/auth.mjs
index c8de651..074099e 100644
--- a/server/auth.mjs
+++ b/server/auth.mjs
@@ -44,7 +44,9 @@ export function signToken(payload) {
 export function verifyToken(token) {
   if (!token || typeof token !== 'string' || !token.includes('.')) return null;
   const [data, sig] = token.split('.');
-  const expected = b64url(crypto.createHmac('sha256', AUTH_SECRET()).update(data).digest());
+  let secret;
+  try { secret = AUTH_SECRET(); } catch { return null; }
+  const expected = b64url(crypto.createHmac('sha256', secret).update(data).digest());
   if (
     sig.length !== expected.length ||
     !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))