fix(auth): remove hardcoded fallback session secret (fixes #59)

FuturMix · FuturMix · commit 46fa8fe93ea1 · 2026-06-14T12:17:20.000+08:00
diff --git a/apps/logicsrc-web/src/lib/coinpay.ts b/apps/logicsrc-web/src/lib/coinpay.ts
@@ -150,7 +150,11 @@ export function getCoinPayOAuthConfig(): CoinPayOAuthConfig | null {
 }
 
 function getSessionSecret(): string {
-  return process.env.LOGICSRC_SESSION_SECRET || process.env.COINPAY_OAUTH_CLIENT_SECRET || "logicsrc-dev-session-secret";
+  const secret = process.env.LOGICSRC_SESSION_SECRET || process.env.COINPAY_OAUTH_CLIENT_SECRET;
+  if (!secret) {
+    throw new Error("LOGICSRC_SESSION_SECRET or COINPAY_OAUTH_CLIENT_SECRET must be set");
+  }
+  return secret;
 }
 
 export function signSession(payload: Record<string, unknown>): string {

Original file line number	Diff line number	Diff line change
`@@ -150,7 +150,11 @@ export function getCoinPayOAuthConfig(): CoinPayOAuthConfig \| null {`
`150`	`150`	`}`
`151`	`151`
`152`	`152`	`function getSessionSecret(): string {`
`153`		`- return process.env.LOGICSRC_SESSION_SECRET \|\| process.env.COINPAY_OAUTH_CLIENT_SECRET \|\| "logicsrc-dev-session-secret";`
	`153`	`+ const secret = process.env.LOGICSRC_SESSION_SECRET \|\| process.env.COINPAY_OAUTH_CLIENT_SECRET;`
	`154`	`+ if (!secret) {`
	`155`	`+ throw new Error("LOGICSRC_SESSION_SECRET or COINPAY_OAUTH_CLIENT_SECRET must be set");`
	`156`	`+ }`
	`157`	`+ return secret;`
`154`	`158`	`}`
`155`	`159`
`156`	`160`	`export function signSession(payload: Record<string, unknown>): string {`