// app/admin/layout.tsx
// Admin layout shell with REAL signed-session auth wiring (agent E).
//
// Auth model: the HMAC-signed session cookie is read by getSession(). When there
// is NO session, the layout renders a bare passthrough (no admin chrome) so the
// /admin/login page can render without a redirect loop. Every gated page and API
// route independently calls requireRole(...) for defense in depth, so a missing
// chrome never means a missing gate. When there IS a session, the layout renders
// the nav + the signed-in identity + a logout control.
//
// The back office is never indexed and never embeddable (admin.md section 3).
import * as React from "react";
import Link from "next/link";
import { getSession } from "@/lib/auth";
import { logoutAction } from "@/app/admin/_lib/actions";
export const metadata = {
robots: { index: false, follow: false },
};
export default async function AdminLayout({
children,
}: Readonly<{ children: React.ReactNode }>) {
const session = await getSession();
// No session: render children bare. The login page lives here and must render
// without the gated chrome; gated pages self-guard with requireRole and will
// redirect to /admin/login themselves.
if (!session) {
return
{children}
;
}
return (
Admin Rifa
{session.email} ({roleLabel(session.role)})
{children}
);
}
function roleLabel(role: string): string {
switch (role) {
case "viewer":
return "lectura";
case "operator":
return "operador";
case "draw_officer":
return "oficial de sorteo";
case "admin":
return "administrador";
default:
return role;
}
}