feat: complete admin invite and user creation and recovery flows

lib/auth.ts

@@ -18,10 +18,12 @@ const accessControl = createAccessControl(defaultStatements);
 // another user's password or email are left out on purpose: the first would
 // show their chats, the others would lock them out of their encrypted API keys.
 // Deleting is left out too, because Better Auth would only remove the account
-// and leave its agents, topics and files behind. /api/admin/users does that.
+// and leave its agents, topics and files behind. Creating is left out so new
+// accounts are always made without a password and with a setup link.
+// /api/admin/users does both.
 const roles = {
     admin: accessControl.newRole({
-        user: ['create', 'list', 'set-role', 'ban', 'get', 'update'],
+        user: ['list', 'set-role', 'ban', 'get', 'update'],
         session: ['list', 'revoke', 'delete'],
     }),
     user: accessControl.newRole({
@@ -74,9 +76,11 @@ export const auth = betterAuth({
                 }
             }
 
-            // creating a user as an admin skips the sign up password rules
-            if (ctx.path === '/admin/create-user') {
-                const password = ctx.body?.password;
+            // Creating a user as an admin skips the sign up password rules. No
+            // password at all is fine: that account can't be signed in to until
+            // its owner sets one with a setup link.
+            if (ctx.path === '/admin/create-user' && ctx.body?.password !== undefined) {
+                const password = ctx.body.password;
                 if (typeof password !== 'string' || password.length < MIN_PASSWORD_LENGTH) {
                     throw new APIError('BAD_REQUEST', {
                         message: 'Password is too short',