Repository: FlowiseAI/Flowise
File: packages/server/src/enterprise/utils/authSecrets.ts (TypeScript)

Code before:
let jwtIssuer: string | undefined
let jwtAudience: string | undefined

const NOT_INITIALIZED = 'Auth secrets not initialized. Call initAuthSecrets() first.'

/**
 * Initialize auth secrets from env (backwards compat) → AWS Secrets Manager → filesystem.
 * Each secret is generated with crypto.randomBytes(32) when created (or 'flowise' for JWT_ISSUER/JWT_AUDIENCE).
 * Call once after getEncryptionKey() in initDatabase().
 */
export async function initAuthSecrets(): Promise<void> {
    tokenHashSecret = await getOrCreateStoredSecret({
        envKey: 'TOKEN_HASH_SECRET',
        fileName: 'token_hash_secret.key',
        awsSecretIdSuffix: 'TokenHashSecret'
    })

    expressSessionSecret = await getOrCreateStoredSecret({
        envKey: 'EXPRESS_SESSION_SECRET',
        fileName: 'express_session_secret.key',
        awsSecretIdSuffix: 'ExpressSessionSecret'
    })

    jwtAuthTokenSecret = await getOrCreateStoredSecret({
        envKey: 'JWT_AUTH_TOKEN_SECRET',
        fileName: 'jwt_auth_token_secret.key',
        awsSecretIdSuffix: 'JWTAuthTokenSecret',
        weakDefault: WEAK_DEFAULTS.JWT_AUTH_TOKEN_SECRET
    })

    jwtRefreshTokenSecret = await getOrCreateStoredSecret({
        envKey: 'JWT_REFRESH_TOKEN_SECRET',
        fileName: 'jwt_refresh_token_secret.key',
        awsSecretIdSuffix: 'JWTRefreshTokenSecret',
        weakDefault: WEAK_DEFAULTS.JWT_REFRESH_TOKEN_SECRET
    })

    jwtIssuer = await getOrCreateStoredSecret({
        envKey: 'JWT_ISSUER',
        fileName: 'jwt_issuer.key',
        awsSecretIdSuffix: 'JWTIssuer',
        defaultValueForNew: 'flowise'
    })

    jwtAudience = await getOrCreateStoredSecret({
        envKey: 'JWT_AUDIENCE',
        fileName: 'jwt_audience.key',
        awsSecretIdSuffix: 'JWTAudience',
        defaultValueForNew: 'flowise'
    })
}

Review comment (security):
Is there a reason we’re not including `weakDefault` in `getOrCreateStoredSecret` and `getOrCreateStoredSecret` functions?

Code after:
let jwtAuthTokenSecret: string | undefined
let jwtRefreshTokenSecret: string | undefined
let jwtIssuer: string | undefined
let jwtAudience: string | undefined

const NOT_INITIALIZED = 'Auth secrets not initialized. Call initAuthSecrets() first.'

/**
 * Initialize auth secrets from env (backwards compat) → AWS Secrets Manager → filesystem.
 * Each secret is generated with crypto.randomBytes(32) when created (or 'flowise' for JWT_ISSUER/JWT_AUDIENCE).
 * Call once after getEncryptionKey() in initDatabase().
 */
export async function initAuthSecrets(): Promise<void> {
    tokenHashSecret = await getOrCreateStoredSecret({
        envKey: 'TOKEN_HASH_SECRET',
        fileName: 'token_hash_secret.key',
        awsSecretIdSuffix: 'TokenHashSecret',
        weakDefault: WEAK_DEFAULTS.TOKEN_HASH_SECRET
    })

    expressSessionSecret = await getOrCreateStoredSecret({
        envKey: 'EXPRESS_SESSION_SECRET',
        fileName: 'express_session_secret.key',
        awsSecretIdSuffix: 'ExpressSessionSecret',
        weakDefault: WEAK_DEFAULTS.EXPRESS_SESSION_SECRET
    })

    jwtAuthTokenSecret = await getOrCreateStoredSecret({
        envKey: 'JWT_AUTH_TOKEN_SECRET',
        fileName: 'jwt_auth_token_secret.key',
        awsSecretIdSuffix: 'JWTAuthTokenSecret',
        weakDefault: WEAK_DEFAULTS.JWT_AUTH_TOKEN_SECRET
    })

    jwtRefreshTokenSecret = await getOrCreateStoredSecret({
        envKey: 'JWT_REFRESH_TOKEN_SECRET',
        fileName: 'jwt_refresh_token_secret.key',
        awsSecretIdSuffix: 'JWTRefreshTokenSecret',
        weakDefault: WEAK_DEFAULTS.JWT_REFRESH_TOKEN_SECRET
    })

    jwtIssuer = await getOrCreateStoredSecret({
        envKey: 'JWT_ISSUER',
        fileName: 'jwt_issuer.key',
        awsSecretIdSuffix: 'JWTIssuer',
        defaultValueForNew: 'flowise'
    })

    jwtAudience = await getOrCreateStoredSecret({
        envKey: 'JWT_AUDIENCE',
        fileName: 'jwt_audience.key',