Make session secret narrowing explicit

318ab90a1e535148c00a6ba71bfbe0e0630e2bbe · 2026-09-08 20:54:15 -0700 · Steve Abrams

Files touched

M lib/auth.ts

Diff

commit 318ab90a1e535148c00a6ba71bfbe0e0630e2bbe
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Sep 8 20:54:15 2026 -0700

    Make session secret narrowing explicit
---
 lib/auth.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/auth.ts b/lib/auth.ts
index be24457..4fa10e7 100644
--- a/lib/auth.ts
+++ b/lib/auth.ts
@@ -2,10 +2,11 @@ import { createHash, createHmac, timingSafeEqual } from 'crypto';
 
 export const AUTH_COOKIE_NAME = 'norma-auth';
 
-const SESSION_SECRET = process.env.SESSION_SECRET;
+const SESSION_SECRET = process.env.SESSION_SECRET as string | undefined;
 if (!SESSION_SECRET) {
   throw new Error('[auth] SESSION_SECRET env var is required');
 }
+const SESSION_SECRET_VALUE: string = SESSION_SECRET;
 const MAX_AGE_SECONDS = 60 * 60 * 24; // 24 hours
 
 /* ─── Types ──────────────────────────────────────────────────────────────── */
@@ -76,7 +77,7 @@ export function createSession(username: string, role: string, orgId: string | nu
   const timestamp = Date.now().toString();
   const payload = JSON.stringify({ u: username, r: role, o: orgId, t: timestamp });
   const payloadB64 = Buffer.from(payload).toString('base64');
-  const signature = createHmac('sha256', SESSION_SECRET)
+  const signature = createHmac('sha256', SESSION_SECRET_VALUE)
     .update(payload)
     .digest('hex');
   return `${payloadB64}.${signature}`;
@@ -103,11 +104,11 @@ export function verifySessionToken(token: string): AuthSession | null {
       }
 
       // Verify HMAC signature (also accept legacy SHA256(payload+secret) for existing sessions)
-      const expected = createHmac('sha256', SESSION_SECRET)
+      const expected = createHmac('sha256', SESSION_SECRET_VALUE)
         .update(payload)
         .digest('hex');
       const legacyExpected = createHash('sha256')
-        .update(payload + SESSION_SECRET)
+        .update(payload + SESSION_SECRET_VALUE)
         .digest('hex');
       try {
         const sigBuffer = Buffer.from(signature, 'hex');

← 9a97f8a Harden Norma OAuth webhooks and release checks · back to Norma · Align Norma lint toolchain and autofix safe issues 494dad3 →