From b508551d0250b7b2e4322be069f5fbc8e5a92dce Mon Sep 17 00:00:00 2001
From: Pascal Dietrich <cameo007@mintux.de>
Date: Sat, 30 May 2026 22:51:28 +0200
Subject: [PATCH] feat: add sessionSecretFile and oauthClientSecretFile for
 JSON config

---
 lib/auth/session-secret.ts  | 7 ++++++-
 lib/oauth/token-exchange.ts | 6 ++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/lib/auth/session-secret.ts b/lib/auth/session-secret.ts
index aceff84f..4bc94a6c 100644
--- a/lib/auth/session-secret.ts
+++ b/lib/auth/session-secret.ts
@@ -23,7 +23,12 @@ export function getSessionSecret(): string {
   if (fromFile) return fromFile;
 
   const fromAdmin = configManager.get<string>('sessionSecret', '');
-  return fromAdmin || '';
+  if (fromAdmin) return fromAdmin;
+
+  const fromAdminFile = readFileEnv(
+    configManager.get<string>('sessionSecretFile', ''),
+  );
+  return fromAdminFile || "";
 }
 
 export function hasSessionSecret(): boolean {
diff --git a/lib/oauth/token-exchange.ts b/lib/oauth/token-exchange.ts
index 32f1956c..51fe2d21 100644
--- a/lib/oauth/token-exchange.ts
+++ b/lib/oauth/token-exchange.ts
@@ -19,6 +19,12 @@ export function getDiscoveryValidator(): EndpointValidator | undefined {
 function getGlobalClientSecret(): string {
   const adminSecret = configManager.get<string>('oauthClientSecret', '');
   if (adminSecret) return adminSecret;
+
+  const adminFileSecret = readFileEnv(
+    configManager.get<string>('oauthClientSecretFile', ''),
+  );
+  if (adminFileSecret) return adminFileSecret;
+
   return process.env.OAUTH_CLIENT_SECRET || readFileEnv(process.env.OAUTH_CLIENT_SECRET_FILE) || '';
 }