feat: complete admin invite and user creation and recovery flows

scripts/recover.ts

@@ -0,0 +1,65 @@
+/**
+ * Prints a one-time recovery link for an account. Meant for whoever runs the
+ * server when nobody can sign in as an admin anymore:
+ *
+ *     bun run recover <email>
+ *
+ * It only talks to the database, the server does not have to be running. The
+ * link works like the ones admins make under Settings → Users: it lets the
+ * account set a new password, deletes its saved API keys, turns two-factor
+ * off and signs every device out.
+ *
+ * Kept free of imports from the app so it also runs in the production image.
+ * The link has to be made the same way as in server/utils/recovery.ts.
+ */
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { Pool } from 'pg';
+
+const LIFETIME_MS = 24 * 60 * 60 * 1000;
+
+const main = async (): Promise<number> => {
+    const email = process.argv[2]?.trim().toLowerCase();
+
+    if (!email) {
+        console.error('Usage: bun run recover <email>');
+        return 1;
+    }
+
+    const pool = new Pool({
+        connectionString: process.env.DATABASE_URL || 'postgres://postgres:password@localhost:5432/veridian',
+    });
+
+    const found = await pool.query('SELECT id, name FROM users WHERE lower(email) = $1', [email]);
+    const user = found.rows[0] as { id: string; name: string } | undefined;
+
+    if (!user) {
+        console.error(`No account with the email ${email}.`);
+        await pool.end();
+        return 1;
+    }
+
+    const token = randomBytes(32).toString('base64url');
+    const tokenHash = createHash('sha256').update(token).digest('hex');
+    const expiresAt = new Date(Date.now() + LIFETIME_MS);
+
+    // only one link works at a time
+    await pool.query('DELETE FROM recovery_links WHERE user_id = $1', [user.id]);
+    await pool.query(
+        'INSERT INTO recovery_links (id, token_hash, user_id, reset_security, expires_at) VALUES ($1, $2, $3, true, $4)',
+        [randomUUID(), tokenHash, user.id, expiresAt],
+    );
+    await pool.end();
+
+    const baseUrl = (process.env.NUXT_PUBLIC_URL ?? 'http://localhost:3000').replace(/\/$/, '');
+
+    console.log(`Recovery link for ${user.name} <${email}>:`);
+    console.log('');
+    console.log(`    ${baseUrl}/auth/recover/${token}`);
+    console.log('');
+    console.log('It works once and expires in 24 hours. Using it deletes the saved API keys');
+    console.log('of this account, turns two-factor off and signs every device out.');
+
+    return 0;
+};
+
+process.exit(await main());