()
| 108 | * valid across restarts). Memoized; mirrors {@link resolveSecretKey}. |
| 109 | */ |
| 110 | export const resolveAuthSecret = (): string => { |
| 111 | if (cachedAuthSecret) return cachedAuthSecret; |
| 112 | const fromEnv = (process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET)?.trim(); |
| 113 | if (fromEnv) { |
| 114 | cachedAuthSecret = fromEnv; |
| 115 | return fromEnv; |
| 116 | } |
| 117 | const keyPath = join(resolveDataDir(), "auth-secret.key"); |
| 118 | if (existsSync(keyPath)) { |
| 119 | cachedAuthSecret = readFileSync(keyPath, "utf8").trim(); |
| 120 | return cachedAuthSecret; |
| 121 | } |
| 122 | mkdirSync(resolveDataDir(), { recursive: true }); |
| 123 | const generated = randomBytes(32).toString("base64"); |
| 124 | writeFileSync(keyPath, generated, { mode: 0o600 }); |
| 125 | console.warn( |
| 126 | `[executor] generated a session secret at ${keyPath}. Set BETTER_AUTH_SECRET to manage it explicitly (rotating it signs everyone out).`, |
| 127 | ); |
| 128 | cachedAuthSecret = generated; |
| 129 | return generated; |
| 130 | }; |
| 131 | |
| 132 | let warnedNoPublicUrl = false; |
| 133 |
no test coverage detected