Arnaud
e0e1ac49d9
- New invites table: token-gated signup, optional email lock, role/tier override, single-use, expiry. - SIGNUPS_DISABLED site setting toggle at /admin/settings. - databaseHooks.user.create gate in auth/server.ts blocks new account creation (email + Google OAuth) when disabled unless a valid invite cookie is present; applies invite role/tier and marks it consumed. - /admin/invites: create/list/revoke shareable invite links. - /admin/users: "Create user" dialog — admin sets email/role/tier, account is pre-verified, user gets a set-password email (admin never sees a password). - Signup page reads ?invite=, validates via public /api/v1/invites/[token], locks the form when signups are closed and no valid invite is present. - proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
58 lines
1.7 KiB
TypeScript
58 lines
1.7 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireAdmin } from "@/lib/api-auth";
|
|
import { db, auditLogs } from "@epicure/db";
|
|
import { createInvite, listInvites } from "@/lib/invites";
|
|
import { randomUUID } from "crypto";
|
|
|
|
const VALID_ROLES = ["user", "moderator", "admin"] as const;
|
|
const VALID_TIERS = ["free", "pro"] as const;
|
|
|
|
export async function GET() {
|
|
const { response } = await requireAdmin();
|
|
if (response) return response;
|
|
|
|
const invites = await listInvites();
|
|
return NextResponse.json({ invites });
|
|
}
|
|
|
|
export async function POST(req: NextRequest) {
|
|
const { session, response } = await requireAdmin();
|
|
if (response) return response;
|
|
|
|
const body = (await req.json()) as {
|
|
email?: string;
|
|
role?: string;
|
|
tier?: string;
|
|
expiresInDays?: number;
|
|
};
|
|
|
|
const role = body.role ?? "user";
|
|
const tier = body.tier ?? "free";
|
|
if (!VALID_ROLES.includes(role as (typeof VALID_ROLES)[number])) {
|
|
return NextResponse.json({ error: "Invalid role" }, { status: 400 });
|
|
}
|
|
if (!VALID_TIERS.includes(tier as (typeof VALID_TIERS)[number])) {
|
|
return NextResponse.json({ error: "Invalid tier" }, { status: 400 });
|
|
}
|
|
|
|
const invite = await createInvite({
|
|
createdById: session!.user.id,
|
|
email: body.email,
|
|
role: role as (typeof VALID_ROLES)[number],
|
|
tier: tier as (typeof VALID_TIERS)[number],
|
|
expiresInDays: body.expiresInDays ?? 7,
|
|
});
|
|
|
|
await db.insert(auditLogs).values({
|
|
id: randomUUID(),
|
|
userId: session!.user.id,
|
|
action: "admin.invite.create",
|
|
targetType: "invite",
|
|
targetId: invite!.id,
|
|
metadata: JSON.stringify({ email: body.email, role, tier }),
|
|
createdAt: new Date(),
|
|
});
|
|
|
|
return NextResponse.json({ invite });
|
|
}
|