feat: admin controls

server/api/admin/users/[id]/two-factor.delete.ts

@@ -1,6 +1,7 @@
 import { eq } from 'drizzle-orm';
 import { twoFactors, users } from '~~/drizzle/schema';
 import { db } from '~~/server/lib/db';
+import { lockAccount, revokeTwoFactorTrust } from "~~/server/lib/account-security";
 
 /**
  * Turns two-factor sign-in off for a user who lost their authenticator app
@@ -26,6 +27,8 @@ export default defineEventHandler(async (event) => {
     }
 
     await db.transaction(async (tx) => {
+        await lockAccount(tx, id);
+        await revokeTwoFactorTrust(tx, id);
         await tx.delete(twoFactors).where(eq(twoFactors.userId, id));
         await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, id));
     });