fix: use $env/dynamic/private for SESSION_SECRET and PASSWORD_HASH

- login/+server.ts: read env vars via $env/dynamic/private (works in Vite dev)
- auth.ts: requireAuth now takes secret as parameter instead of reading process.env
- authRequest.ts: new route-level helper that reads SESSION_SECRET from
  $env/dynamic/private and passes it to requireAuth
- All admin routes updated to import authRequest from authRequest.ts

src/lib/server/auth.ts

@@ -60,11 +60,10 @@ export function verifySession(token: string, secret: string): boolean {
 }
 
 /**
- * Checks the hu_session cookie in the request against SESSION_SECRET env var.
+ * Checks the hu_session cookie in the request against the provided secret.
  * Returns true if a valid session is present.
  */
-export function requireAuth(request: Request): boolean {
+export function requireAuth(request: Request, secret: string): boolean {
-  const secret = process.env.SESSION_SECRET ?? '';
   if (!secret) return false;
   const cookieHeader = request.headers.get('cookie') ?? '';
   const cookies = parse(cookieHeader);
@@ -73,14 +72,6 @@ export function requireAuth(request: Request): boolean {
   return verifySession(token, secret);
 }
 
-/**
- * Convenience: check auth using SESSION_SECRET from env.
- * Avoids repeating requireAuth boilerplate in every route.
- */
-export function authRequest(request: Request): boolean {
-  return requireAuth(request);
-}
-
 /**
  * Build a Set-Cookie Response for session operations.
  * Pass token='' and maxAge=0 to clear the cookie (logout).

src/lib/server/authRequest.ts

@@ -0,0 +1,12 @@
+/**
+ * Route-level auth helper.
+ * Imports SESSION_SECRET from $env/dynamic/private (works in both dev and prod).
+ * Use this in +server.ts and +layout.server.ts files instead of auth.ts directly.
+ */
+import { env } from '$env/dynamic/private';
+import { requireAuth } from '$lib/server/auth';
+import type { Request } from '@sveltejs/kit';
+
+export function authRequest(request: Request): boolean {
+  return requireAuth(request, env.SESSION_SECRET ?? '');
+}

src/routes/admin/+layout.server.ts

@@ -1,5 +1,5 @@
 import { redirect } from '@sveltejs/kit';
-import { authRequest } from '$lib/server/auth';
+import { authRequest } from '$lib/server/authRequest';
 import { loadConfig } from '$lib/server/data';
 import type { LayoutServerLoad } from './$types';
 

src/routes/admin/api/auth/login/+server.ts

@@ -1,4 +1,5 @@
 import { json } from '@sveltejs/kit';
+import { env } from '$env/dynamic/private';
 import { verifyPassword, createSession, sessionResponse, COOKIE_MAX_AGE } from '$lib/server/auth';
 import type { RequestHandler } from './$types';
 
@@ -10,8 +11,8 @@ export const POST: RequestHandler = async ({ request, url }) => {
     return json({ error: 'Password required' }, { status: 400 });
   }
 
-  const passwordHash = process.env.PASSWORD_HASH ?? '';
+  const passwordHash = env.PASSWORD_HASH ?? '';
-  const sessionSecret = process.env.SESSION_SECRET ?? '';
+  const sessionSecret = env.SESSION_SECRET ?? '';
 
   if (!passwordHash || !sessionSecret) {
     console.warn('[humor-units] WARNING: PASSWORD_HASH or SESSION_SECRET env var not set.');

src/routes/admin/api/groups/+server.ts

@@ -1,6 +1,7 @@
 import { json } from '@sveltejs/kit';
 import { loadData, saveData } from '$lib/server/data';
-import { authRequest, KEBAB_RE } from '$lib/server/auth';
+import { authRequest } from '$lib/server/authRequest';
+import { KEBAB_RE } from '$lib/server/auth';
 import type { RequestHandler } from './$types';
 import type { Group } from '$lib/types';
 

src/routes/admin/api/groups/[id]/+server.ts

@@ -1,6 +1,7 @@
 import { json } from '@sveltejs/kit';
 import { loadData, saveData } from '$lib/server/data';
-import { authRequest, KEBAB_RE } from '$lib/server/auth';
+import { authRequest } from '$lib/server/authRequest';
+import { KEBAB_RE } from '$lib/server/auth';
 import type { RequestHandler } from './$types';
 import type { Group } from '$lib/types';
 

src/routes/admin/api/order/+server.ts

@@ -1,6 +1,6 @@
 import { json } from '@sveltejs/kit';
 import { loadData, saveData } from '$lib/server/data';
-import { authRequest } from '$lib/server/auth';
+import { authRequest } from '$lib/server/authRequest';
 import type { RequestHandler } from './$types';
 
 export const PUT: RequestHandler = async ({ request }) => {

src/routes/admin/api/units/+server.ts

@@ -1,6 +1,7 @@
 import { json } from '@sveltejs/kit';
 import { loadData, saveData } from '$lib/server/data';
-import { authRequest, KEBAB_RE } from '$lib/server/auth';
+import { authRequest } from '$lib/server/authRequest';
+import { KEBAB_RE } from '$lib/server/auth';
 import type { RequestHandler } from './$types';
 import type { Unit } from '$lib/types';
 

src/routes/admin/api/units/[id]/+server.ts

@@ -1,6 +1,7 @@
 import { json } from '@sveltejs/kit';
 import { loadData, saveData } from '$lib/server/data';
-import { authRequest, KEBAB_RE } from '$lib/server/auth';
+import { authRequest } from '$lib/server/authRequest';
+import { KEBAB_RE } from '$lib/server/auth';
 import type { RequestHandler } from './$types';
 import type { Unit } from '$lib/types';