AdminLogin validates the admin secret (constant-time) and, on success, emits the admin session cookie as a response side-effect. It is the only admin operation that does not require an existing super-admin session — it establishes one. Logic migrated from internal/graphql/admin_login.go.
(ctx context.Context, meta RequestMetadata, params *model.AdminLoginRequest)
| 17 | // operation that does not require an existing super-admin session — it |
| 18 | // establishes one. Logic migrated from internal/graphql/admin_login.go. |
| 19 | func (p *provider) AdminLogin(ctx context.Context, meta RequestMetadata, params *model.AdminLoginRequest) (*model.Response, *ResponseSideEffects, error) { |
| 20 | log := p.Log.With().Str("func", "AdminLogin").Logger() |
| 21 | if subtle.ConstantTimeCompare([]byte(params.AdminSecret), []byte(p.Config.AdminSecret)) != 1 { |
| 22 | log.Debug().Msg("Invalid admin secret") |
| 23 | metrics.RecordAuthEvent(metrics.EventAdminLogin, metrics.StatusFailure) |
| 24 | metrics.RecordSecurityEvent("invalid_admin_secret", "admin_login") |
| 25 | p.AuditProvider.LogEvent(audit.Event{ |
| 26 | Action: constants.AuditAdminLoginFailedEvent, |
| 27 | Protocol: meta.Protocol, ActorType: constants.AuditActorTypeAdmin, |
| 28 | ResourceType: constants.AuditResourceTypeAdminSession, |
| 29 | IPAddress: meta.IPAddress, |
| 30 | UserAgent: meta.UserAgent, |
| 31 | }) |
| 32 | return nil, nil, Unauthenticated("invalid admin secret") |
| 33 | } |
| 34 | |
| 35 | hashedKey, err := crypto.EncryptPassword(p.Config.AdminSecret) |
| 36 | if err != nil { |
| 37 | return nil, nil, err |
| 38 | } |
| 39 | side := &ResponseSideEffects{} |
| 40 | side.AddCookie(cookie.BuildAdminCookie(meta.HostURL, hashedKey, p.Config.AdminCookieSecure)) |
| 41 | |
| 42 | metrics.RecordAuthEvent(metrics.EventAdminLogin, metrics.StatusSuccess) |
| 43 | p.AuditProvider.LogEvent(audit.Event{ |
| 44 | Action: constants.AuditAdminLoginSuccessEvent, |
| 45 | Protocol: meta.Protocol, ActorType: constants.AuditActorTypeAdmin, |
| 46 | ResourceType: constants.AuditResourceTypeAdminSession, |
| 47 | IPAddress: meta.IPAddress, |
| 48 | UserAgent: meta.UserAgent, |
| 49 | }) |
| 50 | return &model.Response{Message: "admin logged in successfully"}, side, nil |
| 51 | } |
| 52 | |
| 53 | // AdminLogout clears the admin session cookie. Requires super-admin auth. |
| 54 | // Logic migrated from internal/graphql/admin_logout.go. |
nothing calls this directly
no test coverage detected