feat: instance invites

server/api/admin/invites/[id].delete.ts

@@ -0,0 +1,11 @@
+import { eq } from 'drizzle-orm';
+import { invites } from '~~/drizzle/schema';
+import { db } from '~~/server/lib/db';
+
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    await db.delete(invites).where(eq(invites.id, getRouterParam(event, 'id')!));
+
+    return { ok: true };
+});

server/api/admin/invites/index.get.ts

@@ -0,0 +1,21 @@
+import { asc } from 'drizzle-orm';
+import { invites } from '~~/drizzle/schema';
+import { db } from '~~/server/lib/db';
+
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    await deleteDeadInvites();
+
+    return await db
+        .select({
+            id: invites.id,
+            token: invites.token,
+            maxUses: invites.maxUses,
+            uses: invites.uses,
+            expiresAt: invites.expiresAt,
+            createdAt: invites.createdAt,
+        })
+        .from(invites)
+        .orderBy(asc(invites.createdAt));
+});

server/api/admin/invites/index.post.ts

@@ -0,0 +1,28 @@
+import { nanoid } from 'nanoid';
+import { invites } from '~~/drizzle/schema';
+import { db } from '~~/server/lib/db';
+
+const TOKEN_LENGTH = 32;
+
+/** Creates an invite link that lets one person register within a week. */
+export default defineEventHandler(async (event) => {
+    await protectAdminRoute(event);
+
+    const [invite] = await db.insert(invites)
+        .values({
+            token: nanoid(TOKEN_LENGTH),
+            createdBy: event.context.user!.id as string,
+            maxUses: 1,
+            expiresAt: new Date(Date.now() + INVITE_LIFETIME_MS),
+        })
+        .returning({
+            id: invites.id,
+            token: invites.token,
+            maxUses: invites.maxUses,
+            uses: invites.uses,
+            expiresAt: invites.expiresAt,
+            createdAt: invites.createdAt,
+        });
+
+    return invite!;
+});

server/api/invite/[token].get.ts

@@ -0,0 +1,22 @@
+/**
+ * Tells the register page whether an invite link still works and who it is
+ * from. Public on purpose, the person opening the link has no account yet.
+ */
+export default defineEventHandler(async (event) => {
+    const invite = await findUsableInvite(getRouterParam(event, 'token')!);
+
+    if (!invite) {
+        return { valid: false as const };
+    }
+
+    return {
+        valid: true as const,
+        expiresAt: invite.expiresAt,
+        singleUse: invite.maxUses === 1,
+        inviter: {
+            id: invite.inviterId,
+            name: invite.inviterName,
+            image: invite.inviterImage,
+        },
+    };
+});

server/utils/invites.ts

@@ -0,0 +1,52 @@
+import { and, eq, gt, lt, lte, or, sql } from 'drizzle-orm';
+import { invites, users } from '../../drizzle/schema';
+import { db } from '../lib/db';
+
+export const INVITE_TOKEN_HEADER = 'x-invite-token';
+export const INVITE_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+
+// still has uses left and has not run out
+const usable = () => and(lt(invites.uses, invites.maxUses), gt(invites.expiresAt, new Date()));
+
+/**
+ * Takes one use of an invite. It is a single statement, so two people
+ * registering with the same single use link at once cannot both get in.
+ */
+export const claimInvite = async (token: string): Promise<boolean> => {
+    const claimed = await db.update(invites)
+        .set({ uses: sql`${invites.uses} + 1` })
+        .where(and(eq(invites.token, token), usable()))
+        .returning({ id: invites.id });
+
+    return claimed.length > 0;
+};
+
+/** Gives a use back when the registration it was taken for did not go through. */
+export const releaseInvite = async (token: string) => {
+    await db.update(invites)
+        .set({ uses: sql`${invites.uses} - 1` })
+        .where(and(eq(invites.token, token), gt(invites.uses, 0)));
+};
+
+export const findUsableInvite = async (token: string) => {
+    const rows = await db
+        .select({
+            expiresAt: invites.expiresAt,
+            maxUses: invites.maxUses,
+            uses: invites.uses,
+            inviterId: users.id,
+            inviterName: users.name,
+            inviterImage: users.image,
+        })
+        .from(invites)
+        .innerJoin(users, eq(users.id, invites.createdBy))
+        .where(and(eq(invites.token, token), usable()))
+        .limit(1);
+
+    return rows[0] ?? null;
+};
+
+/** Used up and expired invites are of no use to anyone, so they are dropped. */
+export const deleteDeadInvites = async () => {
+    await db.delete(invites).where(or(lte(invites.expiresAt, new Date()), sql`${invites.uses} >= ${invites.maxUses}`));
+};