feat: admin controls

server/api/invite/[token].get.ts

@@ -1,3 +1,19 @@
+import { generateFileToken } from '~~/server/utils/file-token';
+
+const FILE_PREFIX = '/api/files/';
+
+// Uploaded avatars are served to signed in people only, and whoever opens an
+// invite is not signed in yet. A short-lived signed URL lets them see it.
+const publicImage = (image: string | null): string | null => {
+    const secret = process.env.BETTER_AUTH_SECRET;
+
+    if (!image || !image.startsWith(FILE_PREFIX) || !secret) return image;
+
+    const { exp, sig } = generateFileToken(image.slice(FILE_PREFIX.length), secret);
+
+    return `${image}?exp=${exp}&sig=${sig}`;
+};
+
 /**
  * Tells the register page whether an invite link still works and who it is
  * from. Public on purpose, the person opening the link has no account yet.
@@ -16,7 +32,7 @@ export default defineEventHandler(async (event) => {
         inviter: {
             id: invite.inviterId,
             name: invite.inviterName,
-            image: invite.inviterImage,
+            image: publicImage(invite.inviterImage),
         },
     };
 });