1import 'server-only';2import { cookies } from 'next/headers';34/**5 * Admin session = the admin token itself, stored in an httpOnly cookie set by the login server action.6 * It is read only on the server (`cookies()`), forwarded as `x-aia-admin-token`, and never rendered.7 */8export const ADMIN_COOKIE = 'aia-admin';9export const ADMIN_COOKIE_MAX_AGE = 12 * 3600; // 12 h1011export async function getAdminToken(): Promise<string | null> {12 const store = await cookies();13 const v = store.get(ADMIN_COOKIE)?.value;14 return v && v.length > 0 ? v : null;15}1617export async function setAdminToken(token: string): Promise<void> {18 const store = await cookies();19 store.set(ADMIN_COOKIE, token, {20 httpOnly: true,21 sameSite: 'lax',22 secure: process.env.NODE_ENV === 'production',23 path: '/admin',24 maxAge: ADMIN_COOKIE_MAX_AGE,25 });26}2728export async function clearAdminToken(): Promise<void> {29 const store = await cookies();30 store.set(ADMIN_COOKIE, '', { httpOnly: true, sameSite: 'lax', secure: process.env.NODE_ENV === 'production', path: '/admin', maxAge: 0 });31}32