feat: basic admin interface

server/api/admin/users/[id]/index.delete.ts

@@ -0,0 +1,40 @@
+import { db } from '~~/server/lib/db';
+
+/**
+ * Deletes someone else's account and everything that belongs to it.
+ *
+ * Admins delete their own account from their profile, where it asks for the
+ * password and keeps the last admin from leaving.
+ */
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    const id = getRouterParam(event, 'id')!;
+
+    if (id === event.context.user!.id) {
+        throw createError({
+            statusCode: 400,
+            statusMessage: 'You cannot delete your own account here',
+            data: {
+                code: 'CANNOT_DELETE_YOURSELF',
+            },
+        });
+    }
+
+    const account = await db.query.users.findFirst({
+        where: {
+            id,
+        },
+    });
+
+    if (!account) {
+        throw createError({
+            statusCode: 404,
+            statusMessage: 'User not found',
+        });
+    }
+
+    await deleteAccount(id);
+
+    return { ok: true };
+});

server/api/admin/users/[id]/two-factor.delete.ts

@@ -0,0 +1,34 @@
+import { eq } from 'drizzle-orm';
+import { twoFactors, users } from '~~/drizzle/schema';
+import { db } from '~~/server/lib/db';
+
+/**
+ * Turns two-factor sign-in off for a user who lost their authenticator app
+ * and backup codes. They sign in with just their password again and can set
+ * it up from scratch.
+ */
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    const id = getRouterParam(event, 'id')!;
+
+    const account = await db.query.users.findFirst({
+        where: {
+            id,
+        },
+    });
+
+    if (!account) {
+        throw createError({
+            statusCode: 404,
+            statusMessage: 'User not found',
+        });
+    }
+
+    await db.transaction(async (tx) => {
+        await tx.delete(twoFactors).where(eq(twoFactors.userId, id));
+        await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, id));
+    });
+
+    return { ok: true };
+});