From a70924d4b0667bcc0a430397c72c3522819f5f9f Mon Sep 17 00:00:00 2001
From: Hampus <hampus@fluxer.app>
Date: Sun, 6 Sep 2026 15:36:08 +0200
Subject: [PATCH] fix(admin): require the admin secret key base at boot (#2514)

---
 fluxer_admin/src/config/mod.rs | 16 +++++++++++-----
 fluxer_admin/src/main.rs       |  2 +-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/fluxer_admin/src/config/mod.rs b/fluxer_admin/src/config/mod.rs
index 79c971509..237d37106 100644
--- a/fluxer_admin/src/config/mod.rs
+++ b/fluxer_admin/src/config/mod.rs
@@ -41,7 +41,7 @@ pub enum RuntimeEnv {
 }
 
 impl AdminConfig {
-    pub fn from_env() -> Self {
+    pub fn from_env() -> anyhow::Result<Self> {
         let base_path = normalize_base_path(&read_env("FLUXER_ADMIN_BASE_PATH", ""));
         let admin_endpoint = normalize_public_endpoint_from_env(&trim_trailing_slash(&read_env(
             "FLUXER_ADMIN_ENDPOINT",
@@ -51,14 +51,19 @@ impl AdminConfig {
             &["FLUXER_ADMIN_OAUTH_REDIRECT_URI"],
             &format!("{admin_endpoint}/oauth2_callback"),
         ));
+        let secret_key_base = read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "");
+        anyhow::ensure!(
+            !secret_key_base.trim().is_empty(),
+            "FLUXER_ADMIN_SECRET_KEY_BASE is required"
+        );
 
-        Self {
+        Ok(Self {
             env: RuntimeEnv::from_env_value(&read_env("FLUXER_ENV", "development")),
             host: read_env("FLUXER_ADMIN_HOST", "0.0.0.0"),
             port: read_env("FLUXER_ADMIN_PORT", "3020")
                 .parse()
                 .unwrap_or(3020),
-            secret_key_base: read_env("FLUXER_ADMIN_SECRET_KEY_BASE", "development-admin-secret"),
+            secret_key_base,
             base_path,
             api_endpoint: trim_trailing_slash(&read_env(
                 "FLUXER_API_ENDPOINT",
@@ -110,7 +115,7 @@ impl AdminConfig {
                 .trim()
                 .to_ascii_lowercase(),
             },
-        }
+        })
     }
 
     pub fn is_dev(&self) -> bool {
@@ -197,10 +202,11 @@ mod tests {
             unsafe { env::remove_var(name) };
         }
         unsafe { env::remove_var("FLUXER_PUBLIC_PORT") };
+        unsafe { env::set_var("FLUXER_ADMIN_SECRET_KEY_BASE", "test-secret") };
         for (name, value) in vars {
             unsafe { env::set_var(name, value) };
         }
-        let config = AdminConfig::from_env();
+        let config = AdminConfig::from_env().expect("config loads with a secret");
         for (name, _) in vars {
             unsafe { env::remove_var(name) };
         }
diff --git a/fluxer_admin/src/main.rs b/fluxer_admin/src/main.rs
index d22ec9f68..675d6e927 100644
--- a/fluxer_admin/src/main.rs
+++ b/fluxer_admin/src/main.rs
@@ -14,7 +14,7 @@ async fn main() -> anyhow::Result<()> {
         .with(tracing_subscriber::fmt::layer())
         .init();
 
-    let config = AdminConfig::from_env();
+    let config = AdminConfig::from_env()?;
     let addr = format!("{}:{}", config.host, config.port);
     let router = build_router(config);