Persist a per-install JWT signing secret instead of a compiled-in default.

Admin tokens were forgeable whenever JWT_SECRET was unset. Prefer the env var, otherwise write a random key to data/.jwt_secret.

internal/auth/jwt.go

@@ -2,9 +2,13 @@ package auth
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"net/http"
+	"os"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -35,11 +39,56 @@ type JWTManager struct {
 	secret []byte
 }
 
-// NewJWTManager creates a manager. In real use, load secret from secure store or env (never commit real secret).
-// For demo we accept a secret; in production rotate and use env/JWT_SECRET or db meta.
+const jwtSecretFilename = ".jwt_secret"
+
+// LoadOrCreateSecret returns JWT_SECRET from the environment if set, otherwise
+// a per-install secret persisted at dir/.jwt_secret (created on first run).
+func LoadOrCreateSecret(dir string) (string, error) {
+	if s := strings.TrimSpace(os.Getenv("JWT_SECRET")); s != "" {
+		return s, nil
+	}
+	if strings.TrimSpace(dir) == "" {
+		return "", fmt.Errorf("jwt secret directory is required when JWT_SECRET is unset")
+	}
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return "", fmt.Errorf("create jwt secret dir: %w", err)
+	}
+	path := filepath.Join(dir, jwtSecretFilename)
+	if b, err := os.ReadFile(path); err == nil {
+		s := strings.TrimSpace(string(b))
+		if s != "" {
+			return s, nil
+		}
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return "", fmt.Errorf("read jwt secret: %w", err)
+	}
+	s, err := randomSecret()
+	if err != nil {
+		return "", err
+	}
+	if err := os.WriteFile(path, []byte(s+"\n"), 0o600); err != nil {
+		return "", fmt.Errorf("write jwt secret: %w", err)
+	}
+	return s, nil
+}
+
+func randomSecret() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("generate jwt secret: %w", err)
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// NewJWTManager creates a manager. Pass a secret from LoadOrCreateSecret or JWT_SECRET.
+// An empty secret is replaced with a random in-memory value (tokens will not survive restart).
 func NewJWTManager(secret string) *JWTManager {
 	if secret == "" {
-		secret = "dev-only-insecure-secret-change-in-prod"
+		s, err := randomSecret()
+		if err != nil {
+			panic(err)
+		}
+		secret = s
 	}
 	return &JWTManager{secret: []byte(secret)}
 }