feat: complete admin invite and user creation and recovery flows

server/api/recover/[token].get.ts

@@ -0,0 +1,40 @@
+import { and, eq, sql } from 'drizzle-orm';
+import { providers } from '~~/drizzle/schema';
+import { db } from '~~/server/lib/db';
+
+/**
+ * Tells the recovery page whether a link still works and what using it will
+ * do: set the first password of a new account, or replace a forgotten one. Public on purpose: whoever opens it cannot sign in, that is the point.
+ */
+export default defineEventHandler(async (event) => {
+    const link = await findRecoveryLink(getRouterParam(event, 'token')!);
+
+    if (!link) {
+        return { valid: false as const };
+    }
+
+    // an account that never had a password is being set up, not recovered
+    if (!await hasPassword(link.userId)) {
+        return {
+            valid: true as const,
+            newAccount: true as const,
+            email: link.email,
+            name: link.name,
+        };
+    }
+
+    const withKey = await db
+        .select({ name: providers.name })
+        .from(providers)
+        .where(and(eq(providers.userId, link.userId), sql`coalesce(${providers.config}->>'apiKey', '') <> ''`));
+
+    return {
+        valid: true as const,
+        newAccount: false as const,
+        email: link.email,
+        // the providers whose saved key is lost when the link is used
+        keyProviders: withKey.map(p => p.name),
+        resetSecurity: link.resetSecurity,
+        twoFactorEnabled: !!link.twoFactorEnabled,
+    };
+});