Add AUTH_SECRET configuration for AuthPlugin initialization#244
Add AUTH_SECRET configuration for AuthPlugin initialization#244
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds missing configuration required to initialize @objectstack/plugin-auth@2.0.6 so the server can boot successfully, and documents the needed environment variables for local/prod setups.
Changes:
- Configure
AuthPluginwithAUTH_SECRET(andBETTER_AUTH_URL/ base URL) from environment variables. - Add
.env.exampletemplate with auth/database/provider/server variables. - Document environment setup steps in
README.md(including generating a secure secret).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| objectstack.config.ts | Passes env-based secret/baseUrl into AuthPlugin to prevent startup failure. |
| README.md | Documents required AUTH_SECRET and optional env configuration. |
| .env.example | Provides a baseline env template for auth + database + providers + server config. |
| } | ||
| return defaultSecret; | ||
| })(), | ||
| baseUrl: process.env.BETTER_AUTH_URL || 'http://localhost:5320', |
There was a problem hiding this comment.
Defaulting baseUrl to a hard-coded http://localhost:5320 can become incorrect when the server port is changed via PORT/objectstack serve --port. Consider deriving the default from the configured server port (and host if available) or requiring BETTER_AUTH_URL when running on a non-default port.
| baseUrl: process.env.BETTER_AUTH_URL || 'http://localhost:5320', | |
| baseUrl: | |
| process.env.BETTER_AUTH_URL || | |
| `http://${process.env.HOST || 'localhost'}:${process.env.PORT || 5320}`, |
|
|
||
| **Optional Configuration:** | ||
|
|
||
| - **Database**: Defaults to SQLite (`objectstack.db`). Set `OBJECTQL_DATABASE_URL` for PostgreSQL or MongoDB. |
There was a problem hiding this comment.
README states the default SQLite DB is objectstack.db, but the codebase defaults to objectos.db when OBJECTQL_DATABASE_URL is unset (see packages/auth/src/auth-client.ts). This mismatch will mislead users configuring their environment.
| - **Database**: Defaults to SQLite (`objectstack.db`). Set `OBJECTQL_DATABASE_URL` for PostgreSQL or MongoDB. | |
| - **Database**: Defaults to SQLite (`objectos.db`). Set `OBJECTQL_DATABASE_URL` for PostgreSQL or MongoDB. |
| # Optional: Database connection URL (defaults to SQLite: objectstack.db) | ||
| # Examples: | ||
| # - PostgreSQL: postgres://user:password@localhost:5432/objectstack | ||
| # - MongoDB: mongodb://localhost:27017/objectstack | ||
| # - SQLite: sqlite:objectstack.db (or omit for default) | ||
| # OBJECTQL_DATABASE_URL=sqlite:objectstack.db |
There was a problem hiding this comment.
The comments/examples indicate the default SQLite database file is objectstack.db, but the runtime code defaults to objectos.db when OBJECTQL_DATABASE_URL is not set. Update the comment/example to match the actual default to avoid confusion.
| # Optional: Database connection URL (defaults to SQLite: objectstack.db) | |
| # Examples: | |
| # - PostgreSQL: postgres://user:password@localhost:5432/objectstack | |
| # - MongoDB: mongodb://localhost:27017/objectstack | |
| # - SQLite: sqlite:objectstack.db (or omit for default) | |
| # OBJECTQL_DATABASE_URL=sqlite:objectstack.db | |
| # Optional: Database connection URL (defaults to SQLite: objectos.db) | |
| # Examples: | |
| # - PostgreSQL: postgres://user:password@localhost:5432/objectstack | |
| # - MongoDB: mongodb://localhost:27017/objectstack | |
| # - SQLite: sqlite:objectos.db (or omit for default) | |
| # OBJECTQL_DATABASE_URL=sqlite:objectos.db |
| secret: process.env.AUTH_SECRET || (() => { | ||
| const defaultSecret = 'dev-secret-change-in-production-min-32-chars'; | ||
| if (process.env.NODE_ENV === 'production') { | ||
| console.error('WARNING: Using default AUTH_SECRET in production! Set AUTH_SECRET environment variable.'); | ||
| } | ||
| return defaultSecret; | ||
| })(), |
There was a problem hiding this comment.
Falling back to a hard-coded secret means a production deployment can accidentally start with a known AUTH_SECRET. In production, this should fail fast (throw) if AUTH_SECRET is missing/empty, and ideally validate a minimum length (e.g., 32+ chars) before passing it to AuthPlugin.
Server failed to start:
@objectstack/plugin-auth@2.0.6requiressecretparameter butAuthPlugin()was instantiated without options.Changes
objectstack.config.tssecretandbaseUrlto AuthPlugin from env vars.env.exampleREADME.md.env.example, generate secure secret withopenssl rand -base64 32Original prompt
Created from VS Code.
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.