Function run_admin_server

apps/hash-graph/src/subcommand/admin_server.rs:223–307

Runs the admin server until `shutdown` is cancelled.

(
    pool: PostgresStorePool,
    config: AdminConfig,
    shutdown: CancellationToken,
)

/// Runs the admin server until `shutdown` is cancelled.
pub(crate) async fn run_admin_server(
    pool: PostgresStorePool,
    config: AdminConfig,
    shutdown: CancellationToken,
) -> Result<(), Report<GraphError>> {
    let jwt_validator = match (config.jwt.jwks_url, config.jwt.audience, config.jwt.issuer) {
        (Some(jwks_url), Some(audience), Some(issuer)) => {
            if config.unsafe_allow_dev_authentication {
                // Clap `conflicts_with` should prevent this, but guard against it anyway.
                return Err(Report::new(GraphError).attach(
                    "--unsafe-allow-dev-authentication cannot be used with JWT authentication. \
                     Remove the flag or the JWT configuration.",
                ));
            }
            tracing::info!(%jwks_url, "JWT authentication enabled for admin API");
            Some(Arc::new(JwtValidator::new(JwtValidatorConfig {
                jwks_url,
                audience,
                issuer,
                jwks_cache_ttl: Duration::from_secs(config.jwt.jwks_cache_ttl_secs),
                jwks_refresh_cooldown: Duration::from_secs(config.jwt.jwks_refresh_cooldown_secs),
                http_timeout: Duration::from_secs(config.jwt.http_timeout_secs),
                allowed_algorithms: config.jwt.allowed_algorithms,
            })))
        }
        (None, None, None) if config.unsafe_allow_dev_authentication => {
            tracing::warn!(
                "--unsafe-allow-dev-authentication is set -- header-based authentication is \
                 enabled without verification. DO NOT use this in production."
            );
            None
        }
        (None, None, None) => {
            return Err(Report::new(GraphError).attach(
                "no JWT authentication configured and --unsafe-allow-dev-authentication is not \
                 set. Either configure JWT (--jwt-jwks-url, --jwt-audience, --jwt-issuer) or pass \
                 --unsafe-allow-dev-authentication for local development.",
            ));
        }
        _ => {
            // Clap `requires` should prevent this, but guard against it anyway.
            return Err(Report::new(GraphError).attach(
                "partial JWT configuration: --jwt-jwks-url, --jwt-audience, and --jwt-issuer must \
                 all be provided together",
            ));
        }
    };

    let kratos_admin_url = config.external_services.kratos_admin_url.ok_or_else(|| {
        Report::new(GraphError).attach(
            "--kratos-admin-url (HASH_KRATOS_ADMIN_URL) is required when running the admin server",
        )
    })?;
    let hydra_admin_url = config.external_services.hydra_admin_url.ok_or_else(|| {
        Report::new(GraphError).attach(
            "--hydra-admin-url (HASH_HYDRA_ADMIN_URL) is required when running the admin server",
        )
    })?;