feat: admin controls

server/utils/account.ts

@@ -10,6 +10,8 @@ import {
     users,
 } from '~~/drizzle/schema';
 import { db } from '~~/server/lib/db';
+import { hasUsableAdministrator, lockAccount, lockAdministration } from "~~/server/lib/account-security";
+import { Err, Ok } from "~~/types/result";
 
 /**
  * Deletes an account and everything that belongs to it.
@@ -21,7 +23,15 @@ import { db } from '~~/server/lib/db';
  * Objects in file storage are left alone on purpose.
  */
 export const deleteAccount = async (userId: string) => {
-    await db.transaction(async (tx) => {
+    return await db.transaction(async (tx) => {
+        await lockAdministration(tx);
+        await lockAccount(tx, userId);
+
+        const [account] = await tx.select({ role: users.role }).from(users).where(eq(users.id, userId));
+        if (account?.role === "admin" && !await hasUsableAdministrator(tx, userId)) {
+            return Err("LAST_ADMIN" as const);
+        }
+
         // messages, their parts, generations and attachments cascade from topics
         await tx.delete(topics).where(eq(topics.userId, userId));
         await tx.delete(agents).where(eq(agents.userId, userId));
@@ -35,5 +45,6 @@ export const deleteAccount = async (userId: string) => {
 
         // sessions, accounts and two-factor rows cascade from the user
         await tx.delete(users).where(eq(users.id, userId));
+        return Ok(undefined);
     });
 };