Arnaud
e0e1ac49d9
- New invites table: token-gated signup, optional email lock, role/tier override, single-use, expiry. - SIGNUPS_DISABLED site setting toggle at /admin/settings. - databaseHooks.user.create gate in auth/server.ts blocks new account creation (email + Google OAuth) when disabled unless a valid invite cookie is present; applies invite role/tier and marks it consumed. - /admin/invites: create/list/revoke shareable invite links. - /admin/users: "Create user" dialog — admin sets email/role/tier, account is pre-verified, user gets a set-password email (admin never sees a password). - Signup page reads ?invite=, validates via public /api/v1/invites/[token], locks the form when signups are closed and no valid invite is present. - proxy.ts: allowlist /api/v1/invites/ for anonymous invite checks. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
31 lines
890 B
TypeScript
31 lines
890 B
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { requireAdmin } from "@/lib/api-auth";
|
|
import { db, invites, auditLogs, eq } from "@epicure/db";
|
|
import { randomUUID } from "crypto";
|
|
|
|
interface RouteContext {
|
|
params: Promise<{ id: string }>;
|
|
}
|
|
|
|
export async function DELETE(_req: NextRequest, { params }: RouteContext) {
|
|
const { session, response } = await requireAdmin();
|
|
if (response) return response;
|
|
|
|
const { id } = await params;
|
|
const [deleted] = await db.delete(invites).where(eq(invites.id, id)).returning();
|
|
if (!deleted) {
|
|
return NextResponse.json({ error: "Invite not found" }, { status: 404 });
|
|
}
|
|
|
|
await db.insert(auditLogs).values({
|
|
id: randomUUID(),
|
|
userId: session!.user.id,
|
|
action: "admin.invite.revoke",
|
|
targetType: "invite",
|
|
targetId: id,
|
|
createdAt: new Date(),
|
|
});
|
|
|
|
return NextResponse.json({ ok: true });
|
|
}
|