feat(admin): remove invite-by-email, direct-add only

Strips invite-by-email mode from admin user management UI and API. POST /api/admin/users now always requires password parameter for direct user creation. Removes mode toggle, conditional password field, and invite logic branches. Simplifies user creation flow to single path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RkCfBY9L5y3SZ6uaKZzLCV
2026-07-18 17:48:26 +08:00
parent ac2f0724dd
commit 33d4dd4b27
2 changed files with 122 additions and 81 deletions
@@ -30,8 +30,9 @@ export async function POST(request: NextRequest) {
  if (body.role && !isValidRole(body.role))
    return NextResponse.json({ error: 'Invalid role' }, { status: 422 })
  const password = (body.password ?? '').trim()
-  const directCreate = password.length > 0
-  if (directCreate && password.length < 8)
+  if (!password)
+    return NextResponse.json({ error: 'Password required' }, { status: 422 })
+  if (password.length < 8)
    return NextResponse.json({ error: 'Password must be at least 8 characters' }, { status: 422 })

  let admin
@@ -39,14 +40,11 @@ export async function POST(request: NextRequest) {
    admin = createAdminClient()
  } catch {
    return NextResponse.json(
-      { error: 'User invites unavailable: SUPABASE_SERVICE_ROLE_KEY not configured' },
+      { error: 'User creation unavailable: SUPABASE_SERVICE_ROLE_KEY not configured' },
      { status: 503 },
    )
  }

-  // Branch: admin-typed password (instant) vs email invite (link required)
-  let newUserId: string
-  if (directCreate) {
  const { data: created, error: createError } = await admin.auth.admin.createUser({
    email,
    password,
@@ -58,25 +56,8 @@ export async function POST(request: NextRequest) {
      { error: createError?.message ?? 'User creation failed' },
      { status: (createError as { status?: number } | null)?.status ?? 500 },
    )
-    newUserId = created.user.id
-  } else {
-    const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? '').replace(/\/$/, '')
-    if (!appUrl) {
-      return NextResponse.json(
-        { error: 'Invite unavailable: NEXT_PUBLIC_APP_URL not configured' },
-        { status: 503 },
-      )
-    }
-    const { data: invited, error: inviteError } = await admin.auth.admin.inviteUserByEmail(email, {
-      data: { full_name: body.name ?? '' },
-      redirectTo: `${appUrl}/api/auth/callback`,
-    })
-    if (inviteError || !invited?.user)
-      return NextResponse.json({ error: inviteError?.message ?? 'Invite failed' }, { status: 500 })
-    newUserId = invited.user.id
-  }
+  const newUserId = created.user.id

-  // handle_new_auth_user trigger creates the profile row; set fields on top of it
  const { error: profileError } = await admin
    .from('users')
    .update({
@@ -88,15 +69,14 @@ export async function POST(request: NextRequest) {
    .eq('id', newUserId)
  if (profileError)
    return NextResponse.json(
-      { error: `${directCreate ? 'User created' : 'Invite sent'} but profile update failed` },
+      { error: 'User created but profile update failed' },
      { status: 500 },
    )

-  // password is never logged
  await supabase.rpc('write_audit_log', {
    p_table_name: 'users',
    p_record_id: newUserId,
-    p_action: directCreate ? 'created' : 'invited',
+    p_action: 'created',
    p_new_value: { email, role: body.role ?? 'reporter', site_id: body.site_id ?? null },
  })

@@ -148,3 +128,43 @@ export async function PATCH(request: NextRequest) {

  return NextResponse.json({ ok: true })
 }
+
+export async function DELETE(request: NextRequest) {
+  const { supabase, user } = await requireAdmin()
+  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+
+  const { searchParams } = new URL(request.url)
+  const id = searchParams.get('id')
+  if (!id) return NextResponse.json({ error: 'id required' }, { status: 422 })
+  if (id === user.id)
+    return NextResponse.json({ error: 'Cannot delete your own account' }, { status: 422 })
+
+  // fetch user info for audit before deletion
+  const { data: target } = await supabase
+    .from('users').select('email, name, role').eq('id', id).single()
+
+  let admin
+  try {
+    admin = createAdminClient()
+  } catch {
+    return NextResponse.json(
+      { error: 'SUPABASE_SERVICE_ROLE_KEY not configured' },
+      { status: 503 },
+    )
+  }
+
+  const { error } = await admin.auth.admin.deleteUser(id)
+  if (error)
+    return NextResponse.json({ error: error.message ?? 'Deletion failed' }, { status: 500 })
+
+  if (target) {
+    await supabase.rpc('write_audit_log', {
+      p_table_name: 'users',
+      p_record_id: id,
+      p_action: 'deleted',
+      p_new_value: { email: target.email, name: target.name, role: target.role },
+    })
+  }
+
+  return NextResponse.json({ ok: true })
+}
@@ -27,9 +27,9 @@ export function UserManager({ users, sites }: Props) {
  const router = useRouter()
  const [busyId, setBusyId] = useState<string | null>(null)
  const [error, setError] = useState<string | null>(null)
-  const [mode, setMode] = useState<'invite' | 'create'>('invite')
  const [form, setForm] = useState(EMPTY_FORM)
  const [submitting, setSubmitting] = useState(false)
+  const [confirmDeleteId, setConfirmDeleteId] = useState<string | null>(null)

  const patchUser = async (id: string, update: Record<string, unknown>) => {
    setBusyId(id)
@@ -48,27 +48,40 @@ export function UserManager({ users, sites }: Props) {
    router.refresh()
  }

+  const deleteUser = async (id: string) => {
+    setBusyId(id)
+    setError(null)
+    const res = await fetch(`/ims/api/admin/users?id=${encodeURIComponent(id)}`, { method: 'DELETE' })
+    setBusyId(null)
+    setConfirmDeleteId(null)
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}))
+      setError(data.error ?? 'Delete failed')
+      return
+    }
+    router.refresh()
+  }
+
  const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault()
    setSubmitting(true)
    setError(null)
-    const payload: Record<string, unknown> = {
+    const res = await fetch('/ims/api/admin/users', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
        email: form.email,
        name: form.name || undefined,
        phone: form.phone || undefined,
        role: form.role,
        site_id: form.site_id || undefined,
-    }
-    if (mode === 'create') payload.password = form.password
-    const res = await fetch('/ims/api/admin/users', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(payload),
+        password: form.password,
+      }),
    })
    setSubmitting(false)
    if (!res.ok) {
      const data = await res.json().catch(() => ({}))
-      setError(data.error ?? `${mode === 'create' ? 'Add' : 'Invite'} failed`)
+      setError(data.error ?? 'Add failed')
      return
    }
    setForm(EMPTY_FORM)
@@ -79,24 +92,6 @@ export function UserManager({ users, sites }: Props) {
    <div className="bg-white rounded-xl shadow-sm p-5">
      <h2 className="text-sm font-semibold text-gray-700 uppercase tracking-wide mb-4">Users</h2>

-      {/* Mode toggle */}
-      <div className="flex gap-2 mb-4">
-        {(['invite', 'create'] as const).map(m => (
-          <button
-            key={m}
-            type="button"
-            onClick={() => { setMode(m); setError(null) }}
-            className={`text-xs font-medium px-3 py-1.5 rounded-full border transition-colors ${
-              mode === m
-                ? 'bg-gray-800 text-white border-gray-800'
-                : 'border-gray-300 text-gray-600 hover:bg-gray-50'
-            }`}
-          >
-            {m === 'invite' ? 'Invite by email' : 'Add directly'}
-          </button>
-        ))}
-      </div>
-
      <form onSubmit={handleSubmit} className="flex flex-wrap gap-2 mb-5 items-end">
        <input
          type="email" required placeholder="email@company.com"
@@ -131,7 +126,6 @@ export function UserManager({ users, sites }: Props) {
          <option value="">No site</option>
          {sites.map(s => <option key={s.id} value={s.id}>{s.name}</option>)}
        </select>
-        {mode === 'create' && (
        <input
          type="password"
          required
@@ -141,14 +135,11 @@ export function UserManager({ users, sites }: Props) {
          onChange={e => setForm(v => ({ ...v, password: e.target.value }))}
          className="border border-gray-300 rounded-lg px-3 py-2 text-sm w-48"
        />
-        )}
        <button
          type="submit" disabled={submitting}
          className="bg-blue-600 text-white rounded-lg px-4 py-2 text-sm font-semibold hover:bg-blue-700 disabled:opacity-50"
        >
-          {submitting
-            ? (mode === 'create' ? 'Adding…' : 'Inviting…')
-            : (mode === 'create' ? 'Add User' : 'Invite User')}
+          {submitting ? 'Adding…' : 'Add User'}
        </button>
      </form>

@@ -163,6 +154,7 @@ export function UserManager({ users, sites }: Props) {
              <th className="py-2 pr-3">Role</th>
              <th className="py-2 pr-3">Site</th>
              <th className="py-2">Status</th>
+              <th className="py-2"></th>
            </tr>
          </thead>
          <tbody>
@@ -202,6 +194,35 @@ export function UserManager({ users, sites }: Props) {
                    {u.active ? 'Active' : 'Deactivated'}
                  </button>
                </td>
+                <td className="py-2">
+                  {confirmDeleteId === u.id ? (
+                    <span className="flex items-center gap-1">
+                      <span className="text-xs text-red-600 font-medium">Sure?</span>
+                      <button
+                        disabled={busyId === u.id}
+                        onClick={() => deleteUser(u.id)}
+                        className="text-xs px-2 py-0.5 rounded bg-red-600 text-white font-medium hover:bg-red-700"
+                      >
+                        {busyId === u.id ? '…' : 'Yes'}
+                      </button>
+                      <button
+                        disabled={busyId === u.id}
+                        onClick={() => setConfirmDeleteId(null)}
+                        className="text-xs px-2 py-0.5 rounded border border-gray-300 text-gray-600 hover:bg-gray-50"
+                      >
+                        No
+                      </button>
+                    </span>
+                  ) : (
+                    <button
+                      disabled={busyId === u.id}
+                      onClick={() => setConfirmDeleteId(u.id)}
+                      className="text-xs px-2 py-1 rounded text-red-600 hover:bg-red-50 font-medium"
+                    >
+                      Delete
+                    </button>
+                  )}
+                </td>
              </tr>
            ))}
          </tbody>