feat: signup toggle, invite links, admin-created users

- New invites table: token-gated signup, optional email lock, role/tier override, single-use, expiry. - SIGNUPS_DISABLED site setting toggle at /admin/settings. - databaseHooks.user.create gate in auth/server.ts blocks new account creation (email + Google OAuth) when disabled unless a valid invite cookie is present; applies invite role/tier and marks it consumed. - /admin/invites: create/list/revoke shareable invite links. - /admin/users: "Create user" dialog — admin sets email/role/tier, account is pre-verified, user gets a set-password email (admin never sees a password). - Signup page reads ?invite=, validates via public /api/v1/invites/[token], locks the form when signups are closed and no valid invite is present. - proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-03 21:36:40 +02:00
parent c5bc2e1470
commit e0e1ac49d9
22 changed files with 4483 additions and 90 deletions
@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdmin } from "@/lib/api-auth";
+import { db, invites, auditLogs, eq } from "@epicure/db";
+import { randomUUID } from "crypto";
+
+interface RouteContext {
+  params: Promise<{ id: string }>;
+}
+
+export async function DELETE(_req: NextRequest, { params }: RouteContext) {
+  const { session, response } = await requireAdmin();
+  if (response) return response;
+
+  const { id } = await params;
+  const [deleted] = await db.delete(invites).where(eq(invites.id, id)).returning();
+  if (!deleted) {
+    return NextResponse.json({ error: "Invite not found" }, { status: 404 });
+  }
+
+  await db.insert(auditLogs).values({
+    id: randomUUID(),
+    userId: session!.user.id,
+    action: "admin.invite.revoke",
+    targetType: "invite",
+    targetId: id,
+    createdAt: new Date(),
+  });
+
+  return NextResponse.json({ ok: true });
+}
@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdmin } from "@/lib/api-auth";
+import { db, auditLogs } from "@epicure/db";
+import { createInvite, listInvites } from "@/lib/invites";
+import { randomUUID } from "crypto";
+
+const VALID_ROLES = ["user", "moderator", "admin"] as const;
+const VALID_TIERS = ["free", "pro"] as const;
+
+export async function GET() {
+  const { response } = await requireAdmin();
+  if (response) return response;
+
+  const invites = await listInvites();
+  return NextResponse.json({ invites });
+}
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireAdmin();
+  if (response) return response;
+
+  const body = (await req.json()) as {
+    email?: string;
+    role?: string;
+    tier?: string;
+    expiresInDays?: number;
+  };
+
+  const role = body.role ?? "user";
+  const tier = body.tier ?? "free";
+  if (!VALID_ROLES.includes(role as (typeof VALID_ROLES)[number])) {
+    return NextResponse.json({ error: "Invalid role" }, { status: 400 });
+  }
+  if (!VALID_TIERS.includes(tier as (typeof VALID_TIERS)[number])) {
+    return NextResponse.json({ error: "Invalid tier" }, { status: 400 });
+  }
+
+  const invite = await createInvite({
+    createdById: session!.user.id,
+    email: body.email,
+    role: role as (typeof VALID_ROLES)[number],
+    tier: tier as (typeof VALID_TIERS)[number],
+    expiresInDays: body.expiresInDays ?? 7,
+  });
+
+  await db.insert(auditLogs).values({
+    id: randomUUID(),
+    userId: session!.user.id,
+    action: "admin.invite.create",
+    targetType: "invite",
+    targetId: invite!.id,
+    metadata: JSON.stringify({ email: body.email, role, tier }),
+    createdAt: new Date(),
+  });
+
+  return NextResponse.json({ invite });
+}
@@ -13,6 +13,7 @@ const ALLOWED_KEYS: SiteSettingKey[] = [
  "OLLAMA_BASE_URL",
  "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
  "VAPID_PRIVATE_KEY",
+  "SIGNUPS_DISABLED",
 ];

 async function requireAdmin() {
@@ -0,0 +1,100 @@
+import { NextRequest, NextResponse } from "next/server";
+import { requireAdmin } from "@/lib/api-auth";
+import { auth } from "@/lib/auth/server";
+import { db, users, auditLogs, eq } from "@epicure/db";
+import { createInvite, consumeInvite, INVITE_COOKIE } from "@/lib/invites";
+import { randomBytes, randomUUID } from "crypto";
+import { APIError } from "better-auth";
+
+const VALID_ROLES = ["user", "moderator", "admin"] as const;
+const VALID_TIERS = ["free", "pro"] as const;
+
+export async function POST(req: NextRequest) {
+  const { session, response } = await requireAdmin();
+  if (response) return response;
+
+  const body = (await req.json()) as {
+    email?: string;
+    name?: string;
+    role?: string;
+    tier?: string;
+  };
+
+  const email = body.email?.trim().toLowerCase();
+  const name = body.name?.trim();
+  const role = body.role ?? "user";
+  const tier = body.tier ?? "free";
+
+  if (!email || !name) {
+    return NextResponse.json({ error: "email and name are required" }, { status: 400 });
+  }
+  if (!VALID_ROLES.includes(role as (typeof VALID_ROLES)[number])) {
+    return NextResponse.json({ error: "Invalid role" }, { status: 400 });
+  }
+  if (!VALID_TIERS.includes(tier as (typeof VALID_TIERS)[number])) {
+    return NextResponse.json({ error: "Invalid tier" }, { status: 400 });
+  }
+
+  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email));
+  if (existing) {
+    return NextResponse.json({ error: "A user with this email already exists" }, { status: 409 });
+  }
+
+  // Route creation through the same invite gate the public signup flow uses,
+  // so it works identically whether signups are currently open or closed —
+  // and so role/tier assignment goes through the one audited code path.
+  const invite = await createInvite({
+    createdById: session!.user.id,
+    email,
+    role: role as (typeof VALID_ROLES)[number],
+    tier: tier as (typeof VALID_TIERS)[number],
+    expiresInDays: 1,
+  });
+
+  const temporaryPassword = randomBytes(24).toString("base64url");
+
+  try {
+    await auth.api.signUpEmail({
+      body: { email, name, password: temporaryPassword },
+      headers: new Headers({ cookie: `${INVITE_COOKIE}=${invite!.token}` }),
+    });
+  } catch (err) {
+    if (err instanceof APIError) {
+      return NextResponse.json({ error: err.message }, { status: err.statusCode ?? 400 });
+    }
+    throw err;
+  }
+
+  const [created] = await db
+    .update(users)
+    .set({ emailVerified: true })
+    .where(eq(users.email, email))
+    .returning();
+
+  if (!created) {
+    return NextResponse.json({ error: "User creation failed" }, { status: 500 });
+  }
+
+  // The invite gate only consumes on the databaseHooks "after" path when a
+  // cookie is present on a real request; belt-and-suspenders it here too.
+  await consumeInvite(invite!.id, created.id);
+
+  // Let the new user set their own password instead of the admin knowing it.
+  await auth.api.requestPasswordReset({
+    body: { email, redirectTo: "/reset-password" },
+  });
+
+  await db.insert(auditLogs).values({
+    id: randomUUID(),
+    userId: session!.user.id,
+    action: "admin.user.create",
+    targetType: "user",
+    targetId: created.id,
+    metadata: JSON.stringify({ email, role, tier }),
+    createdAt: new Date(),
+  });
+
+  return NextResponse.json({
+    user: { id: created.id, email: created.email, name: created.name, role: created.role, tier: created.tier },
+  });
+}