From 1c445098675bb34a102cddfb9a3f662c7c9aa0bc Mon Sep 17 00:00:00 2001 From: Paperclip Date: Fri, 27 Mar 2026 21:38:25 +0000 Subject: [PATCH] fix(api): validate BETTER_AUTH_SECRET and fix lockfile specifier (GRO-118) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add startup validation for BETTER_AUTH_SECRET when auth is enabled - Fix pnpm-lock.yaml typescript specifier mismatch (^5.9.3 → ^5.7.3) Co-Authored-By: Paperclip --- apps/api/src/lib/auth.ts | 6 ++++++ pnpm-lock.yaml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/apps/api/src/lib/auth.ts b/apps/api/src/lib/auth.ts index a1f3a95..3dda63b 100644 --- a/apps/api/src/lib/auth.ts +++ b/apps/api/src/lib/auth.ts @@ -9,6 +9,12 @@ const OIDC_CLIENT_SECRET = process.env.OIDC_CLIENT_SECRET; const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET; const BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://localhost:3000"; +if (!BETTER_AUTH_SECRET && process.env.AUTH_DISABLED !== "true") { + throw new Error( + "[FATAL] BETTER_AUTH_SECRET environment variable is required when auth is enabled" + ); +} + export const auth = betterAuth({ database: drizzleAdapter(getDb(), { provider: "pg", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1cc64c4..029de5c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -136,7 +136,7 @@ importers: specifier: ^26.1.0 version: 26.1.0 typescript: - specifier: ^5.9.3 + specifier: ^5.7.3 version: 5.9.3 typescript-eslint: specifier: ^8.20.0