fix: defer JWT_SECRET check to runtime (build-time throw)

src/lib/auth.ts

@@ -3,11 +3,11 @@ import { SignJWT, jwtVerify } from 'jose';
 import bcrypt from 'bcryptjs';
 import { db } from './db';
 
-const JWT_SECRET = process.env.JWT_SECRET;
-if (!JWT_SECRET) {
-  throw new Error('JWT_SECRET is not configured');
+function getSecret() {
+  const s = process.env.JWT_SECRET;
+  if (!s) throw new Error('JWT_SECRET is not configured');
+  return new TextEncoder().encode(s);
 }
-const secret = new TextEncoder().encode(JWT_SECRET);
 
 export async function hashPassword(password: string) {
   return bcrypt.hashSync(password, 10);
@@ -39,7 +39,7 @@ export async function createSession(user: { id: number; username: string; role:
   const token = await new SignJWT({ id: user.id, username: user.username, role: user.role })
     .setProtectedHeader({ alg: 'HS256' })
     .setExpirationTime('7d')
-    .sign(secret);
+    .sign(getSecret());
   cookies().set('session', token, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', maxAge: 60 * 60 * 24 * 7 });
   return token;
 }
@@ -48,7 +48,7 @@ export async function getSession() {
   const token = cookies().get('session')?.value;
   if (!token) return null;
   try {
-    const { payload } = await jwtVerify(token, secret);
+    const { payload } = await jwtVerify(token, getSecret());
     return payload as { id: number; username: string; role: string };
   } catch {
     return null;