INNER CODE UNIT · TypeScript

derivationFromEnvironment

bex-co/beancount-io · backend-cluster/backend-v2/src/config/jwks/index.ts:140

function derivationFromEnvironment(): JwksDerivation {
  return {
    fromAuthSecret: process.env.OAUTH_JWKS_FROM_AUTH_SECRET === "true",
    authSecret: process.env.AUTH_SECRET,
  };
}

/**
 * Resolve the authorization server's private signing keys.
 *
 * Development and tests use a process-local ephemeral key so no private JWK is
 * tracked at all. Production must receive a complete private JWKS through the
 * deployment secret boundary. Falling back to a source-controlled key would
 * make every public clone an access-token issuer.
 */
export function getJwks(
  env: Environment,
  serializedProductionJwks: string | undefined = process.env.OAUTH_JWKS,

View source record →