fix: remove hardcoded secrets and use cryptographic randomness

CRITICAL fixes:
- Remove hardcoded private key from .env.test, add to .gitignore
- Remove hardcoded JWT fallback secrets — fail if JWT_SECRET not set
- Replace Math.random() challenge generation with crypto.randomBytes()
  (server) and crypto.getRandomValues() (browser)

Note: the committed private key d217c1ff...ceecf should be considered
compromised and rotated. Use git-filter-branch or BFG to remove from
history if needed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: vveerrgg

.env.test

@@ -2,4 +2,4 @@ PORT=3002
 NODE_ENV=development
 TEST_MODE=true
 LOG_LEVEL=debug
-SERVER_PRIVATE_KEY=d217c1ff2f8a65c3e3a1740db3b9f58b8c848bb45e26d00ed4714e4a0f4ceecf
+SERVER_PRIVATE_KEY=replace_with_test_key

.env.test.example

@@ -0,0 +1,6 @@
+PORT=3002
+NODE_ENV=development
+TEST_MODE=true
+LOG_LEVEL=debug
+SERVER_PRIVATE_KEY=replace_with_test_key
+JWT_SECRET=replace_with_test_jwt_secret

.gitignore

@@ -11,7 +11,9 @@ dist/
 .env
 .env.local
 .env.*.local
+.env.test
 !.env.example
+!.env.test.example
 
 # IDE
 .idea/

src/browser/nostr-browser-auth.ts

@@ -44,7 +44,7 @@ export class NostrBrowserAuth {
    * @returns {Promise<{challenge: string, timestamp: number}>}
    */
   async createChallenge(): Promise<{ challenge: string; timestamp: number }> {
-    const challenge = `${Math.random().toString(36).substring(2, 15)}`;
+    const challenge = Array.from(crypto.getRandomValues(new Uint8Array(32)), b => b.toString(16).padStart(2, '0')).join('');
     const timestamp = Math.floor(Date.now() / 1000);
     return { challenge, timestamp };
   }

src/config.ts

@@ -39,7 +39,11 @@ export const config: NostrAuthConfig = {
   challengePrefix: process.env.CHALLENGE_PREFIX || 'nostr:auth:',
   testMode: process.env.TEST_MODE === 'true',
   logLevel: process.env.LOG_LEVEL || 'info',
-  jwtSecret: getEnvWithWarning('JWT_SECRET') || 'default-secret-do-not-use-in-production',
+  jwtSecret: (() => {
+    const secret = process.env.JWT_SECRET;
+    if (!secret) throw new Error('FATAL: JWT_SECRET environment variable is required');
+    return secret;
+  })(),
   jwtExpiresIn: (process.env.JWT_EXPIRES_IN || '24h') as JWTExpiresIn,
   supabaseUrl: getEnvWithWarning('SUPABASE_URL'),
   supabaseKey: getEnvWithWarning('SUPABASE_KEY'),

src/config/index.ts

@@ -54,9 +54,11 @@ export const config: NostrConfig = {
   privateKey: process.env.SERVER_PRIVATE_KEY,
   keyManagementMode: (process.env.KEY_MANAGEMENT_MODE as 'development' | 'production') || 'development',
   // Auth config
-  jwtSecret: process.env.JWT_SECRET || (process.env.NODE_ENV === 'production' 
-    ? (() => { throw new Error('JWT_SECRET is required in production mode') })()
-    : 'development_jwt_secret_do_not_use_in_production'),
+  jwtSecret: (() => {
+    const secret = process.env.JWT_SECRET;
+    if (!secret) throw new Error('FATAL: JWT_SECRET environment variable is required');
+    return secret;
+  })(),
   jwtExpiresIn: '1h',
   testMode: process.env.TEST_MODE === 'true',
   // Optional configs
@@ -113,9 +115,11 @@ export async function loadConfig(envPath?: string): Promise<NostrConfig> {
     publicKey: process.env.SERVER_PUBLIC_KEY,
     keyManagementMode: process.env.KEY_MANAGEMENT_MODE as 'development' | 'production',
     // Auth config
-    jwtSecret: process.env.JWT_SECRET || (process.env.NODE_ENV === 'production' 
-      ? (() => { throw new Error('JWT_SECRET is required in production mode') })()
-      : 'development_jwt_secret_do_not_use_in_production'),
+    jwtSecret: (() => {
+      const secret = process.env.JWT_SECRET;
+      if (!secret) throw new Error('FATAL: JWT_SECRET environment variable is required');
+      return secret;
+    })(),
     jwtExpiresIn: process.env.JWT_EXPIRES_IN || '24h',
     testMode: process.env.NODE_ENV !== 'production',
     // Optional configs

src/services/nostr.service.ts

@@ -2,6 +2,7 @@
  * @fileoverview Service for handling Nostr authentication operations
  */
 
+import crypto from 'crypto';
 import { NostrEvent, NostrProfile, VerificationResult, NostrAuthConfig } from '../types.js';
 import { createClient, SupabaseClient } from '@supabase/supabase-js';
 import { validateEvent } from '../validators/event.validator.js';
@@ -51,8 +52,8 @@ export class NostrService {
   async createChallenge(pubkey: string): Promise<string> {
     const now = Math.floor(Date.now() / 1000);
     const challenge: SupabaseChallenge = {
-      id: Math.random().toString(36).substring(7),
-      challenge: `${this.config.challengePrefix || 'nostr-auth:'} ${Math.random().toString(36).substring(7)}`,
+      id: crypto.randomBytes(32).toString('hex'),
+      challenge: `${this.config.challengePrefix || 'nostr-auth:'} ${crypto.randomBytes(32).toString('hex')}`,
       created_at: now,
       expires_at: now + Math.floor(this.config.eventTimeoutMs / 1000),
       pubkey