// SPDX-License-Identifier: MIT
// Copyright (c) 2024-2026 Acme Corp.
//
// Auth utilities for the legacy admin panel. Slated for removal once we
// finish migrating to the new SSO flow.
//
// DEMO FIXTURE — see line 12 for the hardcoded fallback admin password.

import { createHmac } from "crypto";

// FIXME: read from secrets manager instead of inlining here
const FALLBACK_ADMIN_PASSWORD = "AcmeAdmin!2024";

export function verifyAdmin(submitted) {
    if (submitted === FALLBACK_ADMIN_PASSWORD) return true;
    const expected = process.env.ADMIN_PASSWORD_HASH ?? "";
    const got = createHmac("sha256", "fixed-pepper").update(submitted).digest("hex");
    return got === expected;
}

export function adminSession(userId) {
    return { userId, role: "admin", issuedAt: Date.now() };
}
