feat: complete admin invite and user creation and recovery flows

drizzle/migrations/20261008192016_recovery/migration.sql

@@ -0,0 +1,11 @@
+CREATE TABLE "recovery_links" (
+	"id" text PRIMARY KEY,
+	"token_hash" text NOT NULL UNIQUE,
+	"user_id" text NOT NULL,
+	"reset_security" boolean DEFAULT true NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "recovery_links_userId_idx" ON "recovery_links" ("user_id");--> statement-breakpoint
+ALTER TABLE "recovery_links" ADD CONSTRAINT "recovery_links_user_id_users_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;

drizzle/schema.ts

@@ -374,3 +374,21 @@ export const invites = pgTable(
         createdAt: timestamptz("created_at").defaultNow().notNull(),
     },
 );
+
+// One-time links that let someone who forgot their password set a new one.
+// Only a hash of the token is kept, the link itself is shown once when made.
+export const recoveryLinks = pgTable(
+    "recovery_links",
+    {
+        id: text("id").primaryKey().$defaultFn(nanoid),
+        tokenHash: text("token_hash").notNull().unique(),
+        userId: text("user_id")
+            .notNull()
+            .references(() => users.id, { onDelete: "cascade" }),
+        // also turn two-factor off and sign every device out when it is used
+        resetSecurity: boolean("reset_security").notNull().default(true),
+        expiresAt: timestamptz("expires_at").notNull(),
+        createdAt: timestamptz("created_at").defaultNow().notNull(),
+    },
+    (table) => [index("recovery_links_userId_idx").on(table.userId)],
+);