rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): centralize JWT secret + 24h TTL (Brief 1 of fix-auth-bypass) #6

Merged
varutasu merged 1 commit from brief/fix-auth-bypass/1-jwt-secret-helper into main 2026-05-23 11:40:51 -04:00
Conversation 2 Commits 1 Files changed 8 +22 -27
8 changed files with 22 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
lib/auth-secret.js Normal file
View file

@ -0,0 +1,12 @@
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
throw new Error(
'JWT_SECRET environment variable is not set. ' +
'Set it in .env.local for local dev, or in the Vercel project settings for deploys. ' +
'Generate a strong secret with: openssl rand -hex 32'
);
}
export { JWT_SECRET };
export const JWT_TOKEN_TTL = '24h';

3
lib/permission-middleware.js
View file

@ -1,7 +1,6 @@
import { sql } from '@vercel/postgres'; import { sql } from '@vercel/postgres';
import jwt from 'jsonwebtoken'; import jwt from 'jsonwebtoken';
import { JWT_SECRET } from './auth-secret.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
/** /**
* Get user ID from request headers * Get user ID from request headers

5
pages/api/auth-utils.js
View file

@ -1,7 +1,6 @@
import jwt from 'jsonwebtoken'; import jwt from 'jsonwebtoken';
import { db } from '../../lib/database.js'; import { db } from '../../lib/database.js';
import { JWT_SECRET, JWT_TOKEN_TTL } from '../../lib/auth-secret.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';
export async function hashPassword(password) { export async function hashPassword(password) {
const bcrypt = await import('bcryptjs'); const bcrypt = await import('bcryptjs');
@ -21,7 +20,7 @@ export function generateToken(user) {
role: user.role role: user.role
}, },
JWT_SECRET, JWT_SECRET,
{ expiresIn: '7d' } { expiresIn: JWT_TOKEN_TTL }
); );
} }

10
pages/api/auth/login.js
View file

@ -1,8 +1,6 @@
import bcrypt from 'bcryptjs'; import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import { sql } from '@vercel/postgres'; import { sql } from '@vercel/postgres';
import { generateToken } from '../auth-utils.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
export default async function handler(req, res) { export default async function handler(req, res) {
// Set CORS headers // Set CORS headers
@ -48,11 +46,7 @@ export default async function handler(req, res) {
} }
// Generate JWT token // Generate JWT token
const token = jwt.sign( const token = generateToken({ id: user.id, email: user.email, role: user.role });
{ userId: user.id, email: user.email, role: user.role },
JWT_SECRET,
{ expiresIn: '24h' }
);
// Return user data (without password) and token // Return user data (without password) and token
const { password: _, ...userWithoutPassword } = user; const { password: _, ...userWithoutPassword } = user;

10
pages/api/auth/register.js
View file

@ -1,9 +1,7 @@
import bcrypt from 'bcryptjs'; import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import { sql } from '@vercel/postgres'; import { sql } from '@vercel/postgres';
import { generateUniqueSlug } from '../../../lib/slug-utils.js'; import { generateUniqueSlug } from '../../../lib/slug-utils.js';
import { generateToken } from '../auth-utils.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
export default async function handler(req, res) { export default async function handler(req, res) {
// Set CORS headers // Set CORS headers
@ -140,11 +138,7 @@ export default async function handler(req, res) {
} }
// Generate JWT token // Generate JWT token
const token = jwt.sign( const token = generateToken({ id: user.id, email: user.email, role: user.role });
{ userId: user.id, email: user.email, role: user.role },
JWT_SECRET,
{ expiresIn: '24h' }
);
// Return user data without password // Return user data without password
const userResponse = { const userResponse = {

3
pages/api/auth/verify.js
View file

@ -1,7 +1,6 @@
import { sql } from '@vercel/postgres'; import { sql } from '@vercel/postgres';
import jwt from 'jsonwebtoken'; import jwt from 'jsonwebtoken';
import { JWT_SECRET } from '../../../lib/auth-secret.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
export default async function handler(req, res) { export default async function handler(req, res) {
// Set CORS headers // Set CORS headers

3
pages/api/favorites.js
View file

@ -1,7 +1,6 @@
import { sql } from '@vercel/postgres'; import { sql } from '@vercel/postgres';
import jwt from 'jsonwebtoken'; import jwt from 'jsonwebtoken';
import { JWT_SECRET } from '../../lib/auth-secret.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
export default async function handler(req, res) { export default async function handler(req, res) {
// Set CORS headers // Set CORS headers

3
pages/api/users/search.js
View file

@ -1,7 +1,6 @@
import { sql } from '@vercel/postgres'; import { sql } from '@vercel/postgres';
import jwt from 'jsonwebtoken'; import jwt from 'jsonwebtoken';
import { JWT_SECRET } from '../../../lib/auth-secret.js';
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
export default async function handler(req, res) { export default async function handler(req, res) {
// Set CORS headers // Set CORS headers