fix: read JWT secret from environment variable instead of hardcoded value (#5)

Author: OpenSauce

.env.example

@@ -0,0 +1,2 @@
+# Required — used to sign JWTs. Generate with: openssl rand -hex 32
+SECRET_KEY=

.github/workflows/ci.yml

@@ -28,6 +28,8 @@ jobs:
 
       - name: Test
         run: pytest backend/tests/
+        env:
+          SECRET_KEY: ci-test-secret
 
   frontend:
     runs-on: ubuntu-latest

.gitignore

@@ -26,6 +26,7 @@ yarn-error.log*
 .pnpm-debug.log*
 
 # local env files
+.env
 .env*.local
 
 # vercel

backend/app/api/users.py

@@ -1,5 +1,6 @@
 # app/api/users.py
 
+import os
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Request, Response, status
@@ -13,7 +14,7 @@
 
 # ─── CONFIG ──────────────────────────────────────────────────────────────
 
-SECRET_KEY = "CHANGE_THIS_TO_A_RANDOM_SECRET"  # override from env in prod
+SECRET_KEY = os.environ["SECRET_KEY"]
 ALGORITHM = "HS256"
 
 pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")

backend/tests/conftest.py

@@ -1,3 +1,7 @@
+import os
+
+os.environ.setdefault("SECRET_KEY", "test-secret")
+
 import pytest
 from sqlalchemy import text
 from sqlmodel import Session, SQLModel, create_engine

docker-compose.yml

@@ -10,6 +10,7 @@ services:
       - db
     environment:
       DEV_MODE: "${DEV_MODE:-}"
+      SECRET_KEY: "${SECRET_KEY}"
     volumes:
       - ./dsa-flash-cards:/data/flashcards