fix(netlify-env): stabilize auth/csrf secrets in SSR runtime via readServerEnv

[LesiaUKR]

Problem

develop on Netlify could return 5xx/502 because some server env vars are not always available through process.env at runtime.

Root cause

Approach #8 (readServerEnv + Netlify fallback) was applied only partially:

• AUTH_SECRET in lib/auth.ts still used direct process.env
• CSRF_SECRET in lib/security/csrf.ts still used direct process.env

Changes

• Updated frontend/lib/auth.ts:
  • read AUTH_SECRET via readServerEnv('AUTH_SECRET')
• Updated frontend/lib/security/csrf.ts:
  • read CSRF_SECRET via readServerEnv('CSRF_SECRET')

Why this is safe

• Server-only usage; no secret exposure to client bundles.
• Existing fail-closed checks remain (throw when secret is truly missing).

Verification checklist

• Open /en on Netlify develop (no 502)
• Call /api/auth/me (no 5xx)
• Run a POST flow protected by CSRF (works as expected)

Summary by CodeRabbit

• Refactor
  • Internal improvements to authentication and security handling.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
devlovers-net	Ignored	Preview	Mar 29, 2026 4:21pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f40e80b1-b5e2-4748-8203-a58bfe68d6dc

📥 Commits

Reviewing files that changed from the base of the PR and between 1ee6d1e and 99abec9.

📒 Files selected for processing (2)

• frontend/lib/auth.ts
• frontend/lib/security/csrf.ts

---

📝 Walkthrough

Walkthrough

Two authentication secret retrieval methods were refactored to use a centralized readServerEnv() helper function instead of directly accessing process.env. The changes affect AUTH_SECRET initialization and CSRF_SECRET retrieval, with all error handling preserved.

Changes

Cohort / File(s)	Summary
Secret Retrieval Refactoring frontend/lib/auth.ts, frontend/lib/security/csrf.ts	Replaced direct process.env access with readServerEnv() helper for AUTH_SECRET and CSRF_SECRET retrieval. Error handling and validation logic remain unchanged.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• Fix Netlify runtime env resolution and Vercel Analytics loading #431: Implements the exact same pattern switch from process.env to readServerEnv() for AUTH_SECRET and CSRF_SECRET across the codebase.
• fix(netlify): hybrid env resolution with Netlify.env.get() fallback #430: Introduces the readServerEnv() helper function and server-env.ts infrastructure that these changes depend on.

Suggested reviewers

• ViktorSvertoka
• AM1007
• liudmylasovetovs

Poem

🐰 A hop through secrets, old and new,
From process.env to helpers true,
AUTH and CSRF now centralized,
Environment readers standardized! 🔐✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(netlify-env): stabilize auth/csrf secrets in SSR runtime via readServerEnv' directly and specifically describes the main change: updating AUTH_SECRET and CSRF_SECRET retrieval to use readServerEnv for SSR stability.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sl/feat/db-optimization

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}