Function readAuth

apps/api/src/config/env/validate.ts:157–186

(source: EnvSource)

});

const readAuth = (source: EnvSource) => ({
  JWT_SECRET: nonEmpty(
    source.JWT_SECRET,
    source.NODE_ENV === "test"
      ? "test-only-jwt-secret-padded-to-thirty-two-chars"
      : ""
  ),
  JWT_REVOCATION_FAIL_CLOSED: toBoolWithDefault(
    source.JWT_REVOCATION_FAIL_CLOSED,
    false,
    "JWT_REVOCATION_FAIL_CLOSED"
  ),
  /*
   * Deterministic test-only key so MFA round-trip tests don't need an
   * env file. 32 bytes base64 = 44 chars. Production deploys must set
   * this to a freshly generated value before any user enables MFA.
   */
  MFA_ENCRYPTION_KEY: nonEmpty(
    source.MFA_ENCRYPTION_KEY,
    source.NODE_ENV === "test"
      ? "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY="
      : ""
  ),
  SUPERUSER_EMAIL: source.SUPERUSER_EMAIL ?? "",
  SUPERUSER_PASSWORD: source.SUPERUSER_PASSWORD ?? "",
  E2E_TEST_ENDPOINTS_ENABLED: toBool(
    source.E2E_TEST_ENDPOINTS_ENABLED,
    "E2E_TEST_ENDPOINTS_ENABLED"
  ),
});

const readUrls = (source: EnvSource) => ({
  FRONTEND_URL: nonEmpty(