/** Single HSE JWT secret for sign and verify across all apps. */
function getJwtSecret() {
  const secret = process.env.JWT_SECRET;
  if (typeof secret === "string" && secret.trim() !== "") {
    return secret.trim();
  }
  if (process.env.NODE_ENV === "test") {
    return "test-jwt-secret";
  }
  throw new Error("JWT_SECRET is not configured");
}

module.exports = { getJwtSecret };
