Refine auth, API proxy, and server routing

server/middleware/auth.js

@@ -1,7 +1,13 @@
 const jwt = require('jsonwebtoken');
 const { AppError } = require('./errorHandler');
 
-const JWT_SECRET = process.env.JWT_SECRET || 'accountbook_secret_key_2024';
+const JWT_SECRET = process.env.JWT_SECRET;
+
+if (!JWT_SECRET && process.env.NODE_ENV === 'production') {
+  throw new Error('JWT_SECRET must be set in production');
+}
+
+const tokenSecret = JWT_SECRET || 'accountbook_secret_key_2024';
 
 function authenticate(req, res, next) {
   const token = req.headers.authorization?.split(' ')[1];
@@ -10,7 +16,7 @@ function authenticate(req, res, next) {
   }
 
   try {
-    const decoded = jwt.verify(token, JWT_SECRET);
+    const decoded = jwt.verify(token, tokenSecret);
     req.userId = decoded.userId;
     next();
   } catch (err) {
@@ -19,11 +25,11 @@ function authenticate(req, res, next) {
 }
 
 function generateToken(userId) {
-  return jwt.sign({ userId }, JWT_SECRET, { expiresIn: '7d' });
+  return jwt.sign({ userId }, tokenSecret, { expiresIn: '7d' });
 }
 
 module.exports = {
   authenticate,
   generateToken,
-  JWT_SECRET,
+  JWT_SECRET: tokenSecret,
 };