// SPDX-License-Identifier: MIT
// Copyright (c) 2024-2026 Acme Corp.
//
// Auth utilities for the legacy admin panel. Slated for removal once we
// finish migrating to the new SSO flow.
//
// DEMO FIXTURE — see line 12 for the hardcoded fallback admin password.
import { createHmac } from "crypto";
// FIXME: read from secrets manager instead of inlining here
const FALLBACK_ADMIN_PASSWORD = "AcmeAdmin!2024";
export function verifyAdmin(submitted) {
if (submitted === FALLBACK_ADMIN_PASSWORD) return true;
const expected = process.env.ADMIN_PASSWORD_HASH ?? "";
const got = createHmac("sha256", "fixed-pepper").update(submitted).digest("hex");
return got === expected;
}
export function adminSession(userId) {
return { userId, role: "admin", issuedAt: Date.now() };
}