feat: admin controls

server/api/setup/index.post.ts

@@ -2,7 +2,7 @@ import { sql } from 'drizzle-orm';
 import * as z from 'zod';
 import { INSTANCE_SETTINGS_ID, instanceSettings, users } from '~~/drizzle/schema';
 import { auth } from '~~/lib/auth';
-import { db } from '~~/server/lib/db';
+import { authTransaction } from '~~/server/lib/auth-transaction';
 
 // any fixed number works, it only has to be the same for every request
 const SETUP_LOCK_ID = 7_261_008;
@@ -40,7 +40,7 @@ export default defineEventHandler(async (event) => {
     let alreadyDone = false;
 
     try {
-        await db.transaction(async (tx) => {
+        await authTransaction(async (tx) => {
             // two people submitting the form at the same moment wait here, and
             // the second one then finds the first one's account
             await tx.execute(sql`select pg_advisory_xact_lock(${SETUP_LOCK_ID})`);