src/auth/auth.service.ts

@@ -6,6 +6,7 @@ import {
 import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import * as bcrypt from 'bcrypt';
+import { randomUUID } from 'crypto';
 import { AdminPrismaService } from '../prisma/admin-prisma.service';
 
 @Injectable()
@@ -119,6 +120,7 @@ export class AuthService {
       sub: adminId,
       email,
       type: 'super_admin',
+      jti: randomUUID(),
     });
 
     const refreshSecret = this.config.get<string>(
@@ -131,7 +133,7 @@ export class AuthService {
     );
 
     const refreshToken = this.jwt.sign(
-      { sub: adminId, email, type: 'super_admin' },
+      { sub: adminId, email, type: 'super_admin', jti: randomUUID() },
       {
         secret: refreshSecret,
         expiresIn: refreshExpiresIn as any,

src/impersonate/impersonate.service.ts

@@ -15,7 +15,7 @@ export class ImpersonateService {
     private readonly audit: AuditService,
   ) {
     // Use the MAIN API's JWT secret so the token works with the tenant API
-    this.mainJwtSecret = this.config.get<string>('JWT_SECRET', 'dev-jwt-secret-not-for-production');
+    this.mainJwtSecret = this.config.get<string>('MAIN_API_JWT_SECRET', 'your-secret-key');
   }
 
   async startImpersonation(tenantId: string, adminId: string, adminName: string) {