# Admin sign-in

`/admin` (reported posts, profiles, season points, the Boosted lane, community pairs) is for the wallets in the
`ADMIN_WALLETS` secret. Code: `app/src/lib/admin/`.

## Signing in

Without an admin session, `/admin` is a sign-in card and nothing else: no panel and no admin data is rendered.

1. Connect an admin wallet and press **Sign in**.
2. The server issues a nonce (`POST /api/admin/nonce`, single use, 5 minutes) with its own time.
3. The wallet signs a standard Sign-In with Ethereum message (EIP-4361) for `openlaunch.lol`, on Base. Wallets that
   support the standard compare its domain with the site asking for the signature and warn on a mismatch, so a
   look-alike site cannot quietly collect an openlaunch sign-in.
4. `POST /api/admin/session` accepts only the exact text the site builds: this domain and URL, Base, the fixed
   statement, a nonce this server issued, issued within 5 minutes. The signer must be in `ADMIN_WALLETS`. The nonce
   must be open before the signature is checked (a made-up one costs no RPC) and is spent only after it checks out.
   Smart wallets are checked on Base.

## The session

- An 8-hour session, never extended. A random 32-byte token sits in a `__Host-ol_admin` cookie: HttpOnly (no page
  script can read it), Secure, SameSite=Strict, Path=/, no Domain (bound to openlaunch.lol exactly, never basebid.lol).
- The database (`bb_admin_sessions`) keeps only the token's SHA-256, a rough device label ("Chrome · macOS") and the
  times. No IP, no user agent.
- Every request checks that the session exists, is not ended, has not expired, and that its wallet is still in
  `ADMIN_WALLETS`. A request never ends sessions itself: while a secret change rolls out, a machine still on the old
  list would end a newly added admin's. Ending a removed wallet's sessions is done at boot (see Ops).
- At most 5 sessions per wallet; signing in again ends the oldest.
- **Sessions** on `/admin` lists this wallet's sessions. Each can be ended, or all of them with **Sign out everywhere**.
  Sign out ends the session on the server, not only in the browser.
- Sign-in, sign-out and every admin action only accept requests from the site's own pages (the Origin header), on top
  of SameSite=Strict. An action must name the wallet that signed it; one without is refused, never treated as a read.
  Sign-in is limited to 10 a minute per IP and per wallet.
- Opening `/admin` from a link on another site sends no Strict cookie on that first load. The card asks the server
  from inside the page and loads the panels when a session is there, so there is no second signature.

## What needs what

| | Session | Its own wallet signature |
|---|---|---|
| The admin page and the admin reads (reported posts, Boost stats, the profile queue, the season boards) | yes | no |
| Every admin action (hide, list, review, season actions, profile moderation) | yes, same wallet | yes, single-use nonce |
| A token's creator muting their own token's thread | no | yes |

A stolen cookie cannot act without the wallet, and a phished action signature cannot act without the cookie.

## Ops

- **Remove an admin**: take the wallet out of `ADMIN_WALLETS` (`fly secrets set ADMIN_WALLETS=… -a basebid`). The
  secret change restarts the machines, and at boot every session of a wallet no longer listed is ended for good
  (retried if the database is briefly unreachable): adding the wallet back later revives none of them. Until a machine
  restarts it still has the old list, so the swap takes as long as the restart (a minute or so).
- **Add an admin**: add the wallet to `ADMIN_WALLETS` the same way, and sign in once both machines have restarted.
- **Adding back a removed wallet**, or if the log shows `[admin] session sweep failed`: end that wallet's old sessions
  first, `UPDATE bb_admin_sessions SET revoked_at = now() WHERE wallet = '<address, lowercase>' AND revoked_at IS NULL;`
  (the boot sweep normally did it already; this covers a sweep that failed all its tries).
- **End every session at once** (a lost device):
  `UPDATE bb_admin_sessions SET revoked_at = now() WHERE revoked_at IS NULL;`
- Sign-ins and sign-outs are logged as `[admin] signed in: <wallet> (<device>)` and `[admin] signed out: …`.