From bd3f3e2d3b27e653ee516d82c53848779d38f30d Mon Sep 17 00:00:00 2001
From: muken <jmendoza14@pm.me>
Date: Sun, 28 Jun 2026 13:22:55 -0500
Subject: [PATCH] fix: defer JWT_SECRET check to runtime (build-time throw)

---
 src/lib/auth.ts | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 71b992b..735bc5f 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -3,11 +3,11 @@ import { SignJWT, jwtVerify } from 'jose';
 import bcrypt from 'bcryptjs';
 import { db } from './db';
 
-const JWT_SECRET = process.env.JWT_SECRET;
-if (!JWT_SECRET) {
-  throw new Error('JWT_SECRET is not configured');
+function getSecret() {
+  const s = process.env.JWT_SECRET;
+  if (!s) throw new Error('JWT_SECRET is not configured');
+  return new TextEncoder().encode(s);
 }
-const secret = new TextEncoder().encode(JWT_SECRET);
 
 export async function hashPassword(password: string) {
   return bcrypt.hashSync(password, 10);
@@ -39,7 +39,7 @@ export async function createSession(user: { id: number; username: string; role:
   const token = await new SignJWT({ id: user.id, username: user.username, role: user.role })
     .setProtectedHeader({ alg: 'HS256' })
     .setExpirationTime('7d')
-    .sign(secret);
+    .sign(getSecret());
   cookies().set('session', token, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', maxAge: 60 * 60 * 24 * 7 });
   return token;
 }
@@ -48,7 +48,7 @@ export async function getSession() {
   const token = cookies().get('session')?.value;
   if (!token) return null;
   try {
-    const { payload } = await jwtVerify(token, secret);
+    const { payload } = await jwtVerify(token, getSecret());
     return payload as { id: number; username: string; role: string };
   } catch {
     return null;