()
| 95 | * valid across restarts). Memoized; mirrors {@link resolveSecretKey}. |
| 96 | */ |
| 97 | export const resolveAuthSecret = (): string => { |
| 98 | if (cachedAuthSecret) return cachedAuthSecret; |
| 99 | const fromEnv = (process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET)?.trim(); |
| 100 | if (fromEnv) { |
| 101 | cachedAuthSecret = fromEnv; |
| 102 | return fromEnv; |
| 103 | } |
| 104 | const keyPath = join(resolveDataDir(), "auth-secret.key"); |
| 105 | if (existsSync(keyPath)) { |
| 106 | cachedAuthSecret = readFileSync(keyPath, "utf8").trim(); |
| 107 | return cachedAuthSecret; |
| 108 | } |
| 109 | mkdirSync(resolveDataDir(), { recursive: true }); |
| 110 | const generated = randomBytes(32).toString("base64"); |
| 111 | writeFileSync(keyPath, generated, { mode: 0o600 }); |
| 112 | console.warn( |
| 113 | `[executor] generated a session secret at ${keyPath}. Set BETTER_AUTH_SECRET to manage it explicitly (rotating it signs everyone out).`, |
| 114 | ); |
| 115 | cachedAuthSecret = generated; |
| 116 | return generated; |
| 117 | }; |
| 118 | |
| 119 | let warnedNoPublicUrl = false; |
| 120 |
no test coverage detected