feat: signup toggle, invite links, admin-created users

- New invites table: token-gated signup, optional email lock,
  role/tier override, single-use, expiry.
- SIGNUPS_DISABLED site setting toggle at /admin/settings.
- databaseHooks.user.create gate in auth/server.ts blocks new account
  creation (email + Google OAuth) when disabled unless a valid invite
  cookie is present; applies invite role/tier and marks it consumed.
- /admin/invites: create/list/revoke shareable invite links.
- /admin/users: "Create user" dialog — admin sets email/role/tier,
  account is pre-verified, user gets a set-password email (admin
  never sees a password).
- Signup page reads ?invite=, validates via public
  /api/v1/invites/[token], locks the form when signups are closed
  and no valid invite is present.
- proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/auth/server.ts

@@ -3,6 +3,8 @@ import { genericOAuth } from "better-auth/plugins";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { db, users, sessions, accounts, verifications, eq, count } from "@epicure/db";
 import { sendEmail, verifyEmailHtml, resetPasswordHtml, welcomeHtml } from "@/lib/email";
+import { isSignupsDisabled } from "@/lib/site-settings";
+import { findValidInvite, consumeInvite, INVITE_COOKIE } from "@/lib/invites";
 
 export const auth = betterAuth({
   trustedOrigins: [process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000"],
@@ -82,12 +84,28 @@ export const auth = betterAuth({
   databaseHooks: {
     user: {
       create: {
-        after: async (user) => {
+        before: async (user, context) => {
+          if (!(await isSignupsDisabled())) return;
+
+          const token = context?.getCookie(INVITE_COOKIE);
+          const invite = token ? await findValidInvite(token, user.email) : null;
+          if (!invite) return false;
+
+          return { data: { ...user, role: invite.role, tier: invite.tier } };
+        },
+        after: async (user, context) => {
           // First registered user becomes admin
           const result = await db.select({ total: count() }).from(users);
           if ((result[0]?.total ?? 0) === 1) {
             await db.update(users).set({ role: "admin" }).where(eq(users.id, user.id));
           }
+
+          // Consume the invite that gated this signup, if any (regardless of
+          // whether signups have since been re-enabled/disabled).
+          const token = context?.getCookie(INVITE_COOKIE);
+          const invite = token ? await findValidInvite(token, user.email) : null;
+          if (invite) await consumeInvite(invite.id, user.id);
+
           // Welcome email (fire and forget)
           sendEmail({
             to: user.email,

apps/web/lib/invites.ts

@@ -0,0 +1,53 @@
+import { db, invites, eq, isNull } from "@epicure/db";
+import { randomUUID, randomBytes } from "crypto";
+
+export const INVITE_COOKIE = "epicure_invite";
+
+export function generateInviteToken(): string {
+  return randomBytes(24).toString("base64url");
+}
+
+export async function findValidInvite(token: string, email?: string | null) {
+  const [invite] = await db.select().from(invites).where(eq(invites.token, token));
+  if (!invite) return null;
+  if (invite.usedAt) return null;
+  if (invite.expiresAt && invite.expiresAt < new Date()) return null;
+  if (invite.email && email && invite.email.toLowerCase() !== email.toLowerCase()) return null;
+  return invite;
+}
+
+export async function consumeInvite(inviteId: string, userId: string): Promise<void> {
+  await db
+    .update(invites)
+    .set({ usedAt: new Date(), usedById: userId })
+    .where(eq(invites.id, inviteId));
+}
+
+export async function createInvite(opts: {
+  createdById: string;
+  email?: string | null;
+  role?: "user" | "moderator" | "admin";
+  tier?: "free" | "pro";
+  expiresInDays?: number | null;
+}) {
+  const [invite] = await db
+    .insert(invites)
+    .values({
+      id: randomUUID(),
+      token: generateInviteToken(),
+      email: opts.email || null,
+      role: opts.role ?? "user",
+      tier: opts.tier ?? "free",
+      createdById: opts.createdById,
+      expiresAt: opts.expiresInDays ? new Date(Date.now() + opts.expiresInDays * 86400_000) : null,
+    })
+    .returning();
+  return invite;
+}
+
+export async function listInvites() {
+  return db.query.invites.findMany({
+    where: isNull(invites.usedAt),
+    orderBy: (i, { desc }) => [desc(i.createdAt)],
+  });
+}

apps/web/lib/site-settings.ts

@@ -8,7 +8,8 @@ export type SiteSettingKey =
   | "OPENROUTER_DEFAULT_MODEL"
   | "OLLAMA_BASE_URL"
   | "NEXT_PUBLIC_VAPID_PUBLIC_KEY"
-  | "VAPID_PRIVATE_KEY";
+  | "VAPID_PRIVATE_KEY"
+  | "SIGNUPS_DISABLED";
 
 const SECRET_KEYS: SiteSettingKey[] = [
   "OPENAI_API_KEY",
@@ -69,6 +70,10 @@ export async function getAllSiteSettings(): Promise<Record<string, { value: stri
   return result;
 }
 
+export async function isSignupsDisabled(): Promise<boolean> {
+  return (await getSiteSetting("SIGNUPS_DISABLED")) === "true";
+}
+
 export async function setSiteSetting(
   key: SiteSettingKey,
   value: string | null,