KrikoriosandClaude Fable 5
eceb6b45d5
SMTP: - Add connection/greeting/socket timeouts so a stalled Gmail connection no longer hangs sign-up - Wrap sendMail in try/catch and fall back to logging the code - Derive secure from port (465 implicit TLS vs 587 STARTTLS) - Strip whitespace from the Gmail app password - Document SMTP_HOST/SMTP_PORT in .env.example and environment.d.ts Password reset (new): - POST /(api)/auth/forgot-password emails a 6-digit code and does not reveal whether the address is registered - POST /(api)/auth/reset-password validates the code, sets the new password, verifies the email, and signs the user in - password_reset_codes table added to seed-db.mjs - "Forgot password?" flow on the mobile sign-in screen User deletion (new): - DELETE /(api)/admin/users/[id], owner-only, blocks self-deletion - Delete button with confirmation on the dashboard Users page Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
95 lines
2.5 KiB
TypeScript
95 lines
2.5 KiB
TypeScript
import { requireOwner, withCors, preflight } from "@/lib/admin";
|
|
import { sql } from "@/lib/db";
|
|
|
|
type Body = {
|
|
role?: string | null;
|
|
email_verified?: boolean;
|
|
};
|
|
|
|
export async function OPTIONS() {
|
|
return preflight();
|
|
}
|
|
|
|
export async function PATCH(request: Request, { id }: { id: string }) {
|
|
const auth = await requireOwner(request);
|
|
if ("error" in auth) return withCors(auth.error);
|
|
|
|
try {
|
|
const body = (await request.json()) as Body;
|
|
|
|
if (body.role !== undefined) {
|
|
const allowed = ["rider", "driver", "owner", null];
|
|
if (!allowed.includes(body.role)) {
|
|
return withCors(
|
|
Response.json(
|
|
{ error: "Role must be rider, driver, owner or null." },
|
|
{ status: 400 },
|
|
),
|
|
);
|
|
}
|
|
|
|
if (id === auth.userId && body.role !== "owner") {
|
|
return withCors(
|
|
Response.json(
|
|
{ error: "You cannot remove your own owner role." },
|
|
{ status: 400 },
|
|
),
|
|
);
|
|
}
|
|
}
|
|
|
|
const rows = await sql<{ id: string; role: string | null; email_verified: boolean }>`
|
|
UPDATE users SET
|
|
role = COALESCE(${body.role ?? null}, role),
|
|
email_verified = COALESCE(${body.email_verified ?? null}, email_verified)
|
|
WHERE id = ${id}
|
|
RETURNING id, role, email_verified
|
|
`;
|
|
|
|
if (!rows[0]) {
|
|
return withCors(Response.json({ error: "User not found." }, { status: 404 }));
|
|
}
|
|
|
|
return withCors(Response.json({ data: rows[0] }));
|
|
} catch (error) {
|
|
console.error("[ADMIN_USER_PATCH]: ", error);
|
|
return withCors(
|
|
Response.json({ error: "Internal Server Error" }, { status: 500 }),
|
|
);
|
|
}
|
|
}
|
|
|
|
export async function DELETE(request: Request, { id }: { id: string }) {
|
|
const auth = await requireOwner(request);
|
|
if ("error" in auth) return withCors(auth.error);
|
|
|
|
if (id === auth.userId) {
|
|
return withCors(
|
|
Response.json(
|
|
{ error: "You cannot delete your own account." },
|
|
{ status: 400 },
|
|
),
|
|
);
|
|
}
|
|
|
|
try {
|
|
// rides.user_id is ON DELETE CASCADE, so a rider's rides go with them.
|
|
const rows = await sql<{ id: string }>`
|
|
DELETE FROM users WHERE id = ${id} RETURNING id
|
|
`;
|
|
|
|
if (!rows[0]) {
|
|
return withCors(
|
|
Response.json({ error: "User not found." }, { status: 404 }),
|
|
);
|
|
}
|
|
|
|
return withCors(Response.json({ data: rows[0] }));
|
|
} catch (error) {
|
|
console.error("[ADMIN_USER_DELETE]: ", error);
|
|
return withCors(
|
|
Response.json({ error: "Internal Server Error" }, { status: 500 }),
|
|
);
|
|
}
|
|
}
|