feat: admin controls

server/api/admin/users/[id]/index.delete.ts

@@ -34,7 +34,14 @@ export default defineEventHandler(async (event) => {
         });
     }
 
-    await deleteAccount(id);
+    const deleted = await deleteAccount(id);
+    if (!deleted.ok) {
+        throw createError({
+            statusCode: 409,
+            statusMessage: "The last usable admin cannot be deleted",
+            data: { code: deleted.error },
+        });
+    }
 
     return { ok: true };
 });

server/api/admin/users/[id]/recovery.post.ts

@@ -12,7 +12,7 @@ export default defineEventHandler(async (event) => {
     const result = await readValidatedBody(event, (body) =>
         z
             .object({
-                // also turn two-factor off and sign every device out
+                // also turn two-factor off, every device is signed out either way
                 resetSecurity: z.boolean(),
             })
             .safeParse(body),

server/api/admin/users/[id]/two-factor.delete.ts

@@ -1,6 +1,7 @@
 import { eq } from 'drizzle-orm';
 import { twoFactors, users } from '~~/drizzle/schema';
 import { db } from '~~/server/lib/db';
+import { lockAccount, revokeTwoFactorTrust } from "~~/server/lib/account-security";
 
 /**
  * Turns two-factor sign-in off for a user who lost their authenticator app
@@ -26,6 +27,8 @@ export default defineEventHandler(async (event) => {
     }
 
     await db.transaction(async (tx) => {
+        await lockAccount(tx, id);
+        await revokeTwoFactorTrust(tx, id);
         await tx.delete(twoFactors).where(eq(twoFactors.userId, id));
         await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, id));
     });