bootstrap

func AdminToken ¶

func AdminToken(s store.Store, raw string) error

AdminToken reconciles the bootstrap admin token from CROW_ADMIN_TOKEN.

When raw is empty the feature is disabled and nothing happens. Otherwise it ensures a dedicated forge-less system admin user owns exactly one access token whose hash equals SHA256(raw): the token is created if missing and any other token owned by that user is deleted, so changing the secret rotates (and revokes) the previous credential.