🐛 Bugfix: Why does Vitto API reject JWT tokens and system tokens that ...

Date: 2026-02-10
Time: 20:57:22 UTC
Session: gspace1-103.8
Agent: backend
Confidence: 100%
Status: ✅ Documented

📋 Decision Context

Question:

Why does Vitto API reject JWT tokens and system tokens that work on backend-api and backend-ai-api?

Task: Fix Vitto API auth - Session 102.3

🎯 Decision Made

Chosen:

Changed Vitto's AuthCoreModule from forRootAsync with config.get('JWT_SECRET') to forRoot with string literal 'JWT_SECRET'. AuthCoreModule expects config KEY NAMES, not values. The auth guard does configService.get(keyName) internally. Passing the actual secret value means the guard looks for a non-existent env var.

Options Considered:

1. Keep forRootAsync with config.get()
2. Switch to forRoot with string literal key names

💭 Reasoning

The bug: config.get('JWT_SECRET', 'JWT_SECRET') evaluates to the ACTUAL secret (e.g., +ylJGL4L...) at module init. This value is passed as jwtSecretKey to the auth guard. The guard then does configService.get('+ylJGL4L...') which returns undefined. Same issue for systemTokenKey. All other backends (backend-api, backend-ai-api, backend-docs-api) correctly pass string literals: AuthCoreModule.forRoot({ jwtSecretKey: 'JWT_SECRET', systemTokenKey: 'SYSTEM_TOKEN' }). The forRootAsync pattern is not needed when passing static key names.

📁 Files Involved

• apis/backend-vitto-api/src/app/app.module.ts
• libs/libs-api/auth-core/src/lib/guards/jwt-auth.guard.ts

🔗 Related

• Decision ID: dev_1770757042229_g1yt3zz
• Session: 103
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation