feat: add app-level authentication foundation

apps/admin-api/src/main.rs

@@ -1,4 +1,5 @@
 mod app;
+mod auth;
 mod error;
 mod routes;
 mod service;
@@ -11,7 +12,12 @@ use crank_registry::PostgresRegistry;
 use tokio::net::TcpListener;
 use tracing::info;
 
-use crate::{app::build_app, service::AdminService, state::AppState};
+use crate::{
+    app::build_app,
+    auth::{AuthSettings, BootstrapAdminConfig},
+    service::AdminService,
+    state::AppState,
+};
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -26,11 +32,28 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         env::var("CRANK_STORAGE_ROOT").unwrap_or_else(|_| "/var/lib/crank/storage".into()),
     );
     let bind_addr = env::var("CRANK_ADMIN_BIND").unwrap_or_else(|_| "0.0.0.0:3001".into());
+    let public_base_url =
+        env::var("CRANK_PUBLIC_BASE_URL").unwrap_or_else(|_| "http://localhost:3000".into());
     let socket_addr: SocketAddr = bind_addr.parse()?;
     let registry = PostgresRegistry::connect(&database_url).await?;
-    let state = AppState {
-        service: AdminService::new(registry, storage_root),
+    let auth_settings = AuthSettings {
+        session_secret: env::var("CRANK_SESSION_SECRET")?,
+        password_pepper: env::var("CRANK_PASSWORD_PEPPER")?,
+        session_ttl_hours: env::var("CRANK_SESSION_TTL_HOURS")
+            .ok()
+            .and_then(|value| value.parse::<i64>().ok())
+            .unwrap_or(24),
+        cookie_secure: public_base_url.starts_with("https://"),
+        bootstrap_admin: BootstrapAdminConfig {
+            email: env::var("CRANK_BOOTSTRAP_ADMIN_EMAIL")?,
+            password: env::var("CRANK_BOOTSTRAP_ADMIN_PASSWORD")?,
+            display_name: env::var("CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME")
+                .unwrap_or_else(|_| "Crank Owner".into()),
+        },
     };
+    let service = AdminService::new(registry, storage_root, auth_settings);
+    service.bootstrap_admin_user().await?;
+    let state = AppState { service };
     let app = build_app(state);
     let listener = TcpListener::bind(socket_addr).await?;