()
| 130 | * valid across restarts). Memoized; mirrors {@link resolveSecretKey}. |
| 131 | */ |
| 132 | export const resolveAuthSecret = (): string => { |
| 133 | if (cachedAuthSecret) return cachedAuthSecret; |
| 134 | const fromEnv = (process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET)?.trim(); |
| 135 | if (fromEnv) { |
| 136 | cachedAuthSecret = fromEnv; |
| 137 | return fromEnv; |
| 138 | } |
| 139 | const keyPath = join(resolveDataDir(), "auth-secret.key"); |
| 140 | if (existsSync(keyPath)) { |
| 141 | cachedAuthSecret = readFileSync(keyPath, "utf8").trim(); |
| 142 | return cachedAuthSecret; |
| 143 | } |
| 144 | mkdirSync(resolveDataDir(), { recursive: true }); |
| 145 | const generated = randomBytes(32).toString("base64"); |
| 146 | writeFileSync(keyPath, generated, { mode: 0o600 }); |
| 147 | console.warn( |
| 148 | `[executor] generated a session secret at ${keyPath}. Set BETTER_AUTH_SECRET to manage it explicitly (rotating it signs everyone out).`, |
| 149 | ); |
| 150 | cachedAuthSecret = generated; |
| 151 | return generated; |
| 152 | }; |
| 153 | |
| 154 | let warnedNoPublicUrl = false; |
| 155 |
no test coverage detected