From 452bd03f747a0a4852daa3902e1671abda2dbc57 Mon Sep 17 00:00:00 2001
From: moonevm <153745470+moonevm@users.noreply.github.com>
Date: Wed, 24 Jun 2026 23:52:53 +0200
Subject: [PATCH] =?UTF-8?q?fix(cli):=20increase=20generated=20BETTER=5FAUT?=
 =?UTF-8?q?H=5FSECRET=20length=20from=2016=20to=2032=20=E2=80=A6=20(#10186?=
 =?UTF-8?q?)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Maxwell <145994855+ping-maxwell@users.noreply.github.com>
---
 packages/cli/src/utils/helper.ts |  2 +-
 packages/cli/test/init.test.ts   | 16 +++++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/utils/helper.ts b/packages/cli/src/utils/helper.ts
index 6ecfe24fd2..6c165c7298 100644
--- a/packages/cli/src/utils/helper.ts
+++ b/packages/cli/src/utils/helper.ts
@@ -25,7 +25,7 @@ export async function tryCatch<T, E = Error>(
 }
 
 export const generateSecretHash = () => {
-	return Crypto.randomBytes(16).toString("hex");
+	return Crypto.randomBytes(32).toString("hex");
 };
 
 export const spawnCommand = (cmd: string, cwd: string = process.cwd()) =>
diff --git a/packages/cli/test/init.test.ts b/packages/cli/test/init.test.ts
index 8fbc8032ee..ab4801cb99 100644
--- a/packages/cli/test/init.test.ts
+++ b/packages/cli/test/init.test.ts
@@ -155,7 +155,7 @@ describe("initAction", () => {
 					return { value: true };
 				}
 				if (question.name === "providedSecret") {
-					return { providedSecret: "test-secret-123" };
+					return { providedSecret: "" };
 				}
 				if (question.name === "providedURL") {
 					return { providedURL: "http://localhost:3000" };
@@ -256,6 +256,20 @@ describe("initAction", () => {
 				.then(() => true)
 				.catch(() => false);
 			expect(envExists).toBe(true);
+
+			const envContent = await fs.readFile(envPath, "utf-8");
+
+			const line = envContent
+				.toString()
+				.split("\n")
+				.find((l) => l.startsWith("BETTER_AUTH_SECRET="));
+
+			expect(line).toBeDefined();
+
+			const secret = line!.split("=")[1]?.replaceAll('"', "").trim();
+
+			expect(secret).toBeDefined();
+			expect(secret!.length).toBeGreaterThanOrEqual(64); // 64 characters 32 hex bytes
 		},
 	);