()
| 139 | * valid across restarts). Memoized; mirrors {@link resolveSecretKey}. |
| 140 | */ |
| 141 | export const resolveAuthSecret = (): string => { |
| 142 | if (cachedAuthSecret) return cachedAuthSecret; |
| 143 | const fromEnv = (process.env.BETTER_AUTH_SECRET ?? process.env.AUTH_SECRET)?.trim(); |
| 144 | if (fromEnv) { |
| 145 | cachedAuthSecret = fromEnv; |
| 146 | return fromEnv; |
| 147 | } |
| 148 | const keyPath = join(resolveDataDir(), "auth-secret.key"); |
| 149 | if (existsSync(keyPath)) { |
| 150 | cachedAuthSecret = readFileSync(keyPath, "utf8").trim(); |
| 151 | return cachedAuthSecret; |
| 152 | } |
| 153 | mkdirSync(resolveDataDir(), { recursive: true }); |
| 154 | const generated = randomBytes(32).toString("base64"); |
| 155 | writeFileSync(keyPath, generated, { mode: 0o600 }); |
| 156 | console.warn( |
| 157 | `[executor] generated a session secret at ${keyPath}. Set BETTER_AUTH_SECRET to manage it explicitly (rotating it signs everyone out).`, |
| 158 | ); |
| 159 | cachedAuthSecret = generated; |
| 160 | return generated; |
| 161 | }; |
| 162 | |
| 163 | let warnedNoPublicUrl = false; |
| 164 |
no test coverage detected