feat: complete admin invite and user creation and recovery flows

server/api/admin/users/[id]/recovery.delete.ts

@@ -0,0 +1,12 @@
+import { eq } from 'drizzle-orm';
+import { recoveryLinks } from '~~/drizzle/schema';
+import { db } from '~~/server/lib/db';
+
+/** Cancels the recovery link of a user, if there is one. */
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    await db.delete(recoveryLinks).where(eq(recoveryLinks.userId, getRouterParam(event, 'id')!));
+
+    return { ok: true };
+});

server/api/admin/users/[id]/recovery.post.ts

@@ -0,0 +1,44 @@
+import * as z from 'zod';
+import { db } from '~~/server/lib/db';
+
+/**
+ * Makes a one-time link the user can set a new password with, or their first
+ * one if the account was created by an admin and never had a password. The link is
+ * only returned here, afterwards nobody can read it back, admins included.
+ */
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    const result = await readValidatedBody(event, (body) =>
+        z
+            .object({
+                // also turn two-factor off and sign every device out
+                resetSecurity: z.boolean(),
+            })
+            .safeParse(body),
+    );
+
+    if (!result.success) {
+        throw createError({
+            statusCode: 400,
+            message: result.error.issues[0]!.message,
+        });
+    }
+
+    const id = getRouterParam(event, 'id')!;
+
+    const account = await db.query.users.findFirst({
+        where: {
+            id,
+        },
+    });
+
+    if (!account) {
+        throw createError({
+            statusCode: 404,
+            statusMessage: 'User not found',
+        });
+    }
+
+    return await createRecoveryLink(id, result.data.resetSecurity);
+});

server/api/admin/users/index.get.ts

@@ -1,5 +1,5 @@
-import { asc, eq, max } from 'drizzle-orm';
-import { sessions, users } from '~~/drizzle/schema';
+import { asc, eq, max, sql } from 'drizzle-orm';
+import { accounts, sessions, users } from '~~/drizzle/schema';
 import { db } from '~~/server/lib/db';
 
 /**
@@ -24,6 +24,9 @@ export default defineEventHandler(async (event) => {
             // sessions are touched as they are used, the newest one is the
             // closest thing there is to a last seen time
             lastActiveAt: max(sessions.updatedAt),
+            // no password yet: created by an admin and still waiting for its
+            // owner to open the setup link
+            pending: sql<boolean>`not exists (select 1 from ${accounts} where ${accounts.userId} = ${users.id} and ${accounts.providerId} = 'credential')`,
         })
         .from(users)
         .leftJoin(sessions, eq(sessions.userId, users.id))

server/api/admin/users/index.post.ts

@@ -0,0 +1,63 @@
+import * as z from 'zod';
+import { auth } from '~~/lib/auth';
+
+/**
+ * Creates an account for someone, without a password. Nobody can sign in to
+ * it until its owner opens the setup link returned here and picks one, so the
+ * admin never knows a password of theirs. The link is only returned here.
+ */
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    const result = await readValidatedBody(event, (body) =>
+        z
+            .object({
+                name: z.string().trim().min(1).max(128),
+                email: z.email(),
+            })
+            .safeParse(body),
+    );
+
+    if (!result.success) {
+        throw createError({
+            statusCode: 400,
+            message: result.error.issues[0]!.message,
+            data: {
+                code: 'INVALID_BODY',
+            },
+        });
+    }
+
+    const { name, email } = result.data;
+
+    let userId: string;
+
+    try {
+        // called without the request, the admin check already happened above
+        const { user } = await auth.api.createUser({
+            body: {
+                name,
+                email,
+                role: 'user',
+            },
+        });
+
+        userId = user.id;
+    } catch (error: any) {
+        const code = error?.body?.code as string | undefined;
+
+        if (code === undefined) {
+            console.error('Failed to create user:', error);
+        }
+
+        throw createError({
+            statusCode: code === undefined ? 500 : 400,
+            statusMessage: 'Failed to create user',
+            data: {
+                code: code ?? 'INTERNAL_ERROR',
+            },
+        });
+    }
+
+    return await createRecoveryLink(userId, false);
+});