Arnaud
e0e1ac49d9
- New invites table: token-gated signup, optional email lock, role/tier override, single-use, expiry. - SIGNUPS_DISABLED site setting toggle at /admin/settings. - databaseHooks.user.create gate in auth/server.ts blocks new account creation (email + Google OAuth) when disabled unless a valid invite cookie is present; applies invite role/tier and marks it consumed. - /admin/invites: create/list/revoke shareable invite links. - /admin/users: "Create user" dialog — admin sets email/role/tier, account is pre-verified, user gets a set-password email (admin never sees a password). - Signup page reads ?invite=, validates via public /api/v1/invites/[token], locks the form when signups are closed and no valid invite is present. - proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
16 lines
464 B
TypeScript
16 lines
464 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { findValidInvite } from "@/lib/invites";
|
|
|
|
interface RouteContext {
|
|
params: Promise<{ token: string }>;
|
|
}
|
|
|
|
export async function GET(_req: NextRequest, { params }: RouteContext) {
|
|
const { token } = await params;
|
|
const invite = await findValidInvite(token);
|
|
if (!invite) {
|
|
return NextResponse.json({ valid: false });
|
|
}
|
|
return NextResponse.json({ valid: true, email: invite.email });
|
|
}
|