45 lines
1.2 KiB
TypeScript
45 lines
1.2 KiB
TypeScript
import * as z from 'zod';
|
|
import { db } from '~~/server/lib/db';
|
|
|
|
/**
|
|
* Makes a one-time link the user can set a new password with, or their first
|
|
* one if the account was created by an admin and never had a password. The link is
|
|
* only returned here, afterwards nobody can read it back, admins included.
|
|
*/
|
|
export default defineEventHandler(async (event) => {
|
|
await protectAdminRoute(event);
|
|
|
|
const result = await readValidatedBody(event, (body) =>
|
|
z
|
|
.object({
|
|
// also turn two-factor off and sign every device out
|
|
resetSecurity: z.boolean(),
|
|
})
|
|
.safeParse(body),
|
|
);
|
|
|
|
if (!result.success) {
|
|
throw createError({
|
|
statusCode: 400,
|
|
message: result.error.issues[0]!.message,
|
|
});
|
|
}
|
|
|
|
const id = getRouterParam(event, 'id')!;
|
|
|
|
const account = await db.query.users.findFirst({
|
|
where: {
|
|
id,
|
|
},
|
|
});
|
|
|
|
if (!account) {
|
|
throw createError({
|
|
statusCode: 404,
|
|
statusMessage: 'User not found',
|
|
});
|
|
}
|
|
|
|
return await createRecoveryLink(id, result.data.resetSecurity);
|
|
});
|