feat: setup and roles

server/api/account/index.delete.ts

@@ -1,4 +1,4 @@
-import { eq } from 'drizzle-orm';
+import { and, eq, ne } from 'drizzle-orm';
 import * as z from 'zod';
 import {
     agents,
@@ -57,6 +57,25 @@ export default defineEventHandler(async (event) => {
 
     const twoFactorEnabled = !!account?.twoFactorEnabled;
 
+    // an instance always keeps one admin, someone has to be able to manage it
+    if (account?.role === 'admin') {
+        const otherAdmins = await db
+            .select({ id: users.id })
+            .from(users)
+            .where(and(eq(users.role, 'admin'), ne(users.id, userId)))
+            .limit(1);
+
+        if (otherAdmins.length === 0) {
+            throw createError({
+                statusCode: 409,
+                statusMessage: 'The last admin cannot be deleted',
+                data: {
+                    code: 'LAST_ADMIN',
+                },
+            });
+        }
+    }
+
     if (twoFactorEnabled && code === undefined) {
         throw createError({
             statusCode: 400,