handoff-app 2.0.0-2 → 2.0.0-3

package/src/app/pages/account/users.tsx

@@ -0,0 +1,310 @@
+import { AccountLayout } from '../../components/Auth/AccountLayout';
+import { authApiUrl, readApiError } from '../../components/Auth/api';
+import { Alert, AlertDescription, AlertTitle } from '../../components/ui/alert';
+import { Badge } from '../../components/ui/badge';
+import { Button } from '../../components/ui/button';
+import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle } from '../../components/ui/card';
+import { Input } from '../../components/ui/input';
+import { Label } from '../../components/ui/label';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../../components/ui/select';
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '../../components/ui/table';
+import { Check, Copy, MailPlus, RefreshCw } from 'lucide-react';
+import { useSession } from 'next-auth/react';
+import { useRouter } from 'next/router';
+import { FormEvent, useCallback, useEffect, useState } from 'react';
+
+interface RegistryUser {
+  id: string;
+  name?: string | null;
+  email: string;
+  role: 'admin' | 'member';
+  status: 'invited' | 'active' | 'deactivated';
+  emailVerified?: string | null;
+  createdAt?: string;
+}
+
+interface MutationResult {
+  activationUrl?: string;
+  inviteUrl?: string;
+  message?: string;
+}
+
+export default function UsersPage() {
+  if (process.env.HANDOFF_RUNTIME_MODE !== 'registry') {
+    return <AccountLayout title="Users">{null}</AccountLayout>;
+  }
+
+  return <RegistryUsersPage />;
+}
+
+function RegistryUsersPage() {
+  const router = useRouter();
+  const { data: session, status: sessionStatus } = useSession();
+  const currentUser = session?.user as (typeof session.user & { id?: string; role?: string }) | undefined;
+  const [users, setUsers] = useState<RegistryUser[]>([]);
+  const [inviteRole, setInviteRole] = useState<'member' | 'admin'>('member');
+  const [pending, setPending] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [success, setSuccess] = useState<string | null>(null);
+  const [manualLink, setManualLink] = useState<string | null>(null);
+  const [copied, setCopied] = useState(false);
+
+  useEffect(() => {
+    if (sessionStatus === 'authenticated' && currentUser?.role !== 'admin') void router.replace('/account');
+  }, [currentUser?.role, router, sessionStatus]);
+
+  const load = useCallback(async () => {
+    const response = await fetch(authApiUrl('/api/admin/users'), { credentials: 'include', cache: 'no-store' });
+    if (!response.ok) throw new Error(await readApiError(response, 'Could not load users.'));
+    const body = (await response.json()) as RegistryUser[] | { users: RegistryUser[] };
+    const rows = Array.isArray(body) ? body : body.users;
+    setUsers(
+      rows.map((user) => ({
+        ...user,
+        status: user.status ?? (user.emailVerified ? 'active' : 'invited'),
+      }))
+    );
+  }, []);
+
+  useEffect(() => {
+    if (currentUser?.role === 'admin') void load().catch((reason: Error) => setError(reason.message));
+  }, [currentUser?.role, load]);
+
+  const showResult = (body: MutationResult, fallback: string) => {
+    setSuccess(body.message ?? fallback);
+    setManualLink(body.activationUrl ?? body.inviteUrl ?? null);
+  };
+
+  const invite = async (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    setPending(true);
+    setError(null);
+    setSuccess(null);
+    setManualLink(null);
+    const form = event.currentTarget;
+    const data = new FormData(form);
+    try {
+      const response = await fetch(authApiUrl('/api/admin/users'), {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          email: String(data.get('email') ?? '')
+            .trim()
+            .toLowerCase(),
+          name: String(data.get('name') ?? '').trim(),
+          role: inviteRole,
+        }),
+      });
+      if (!response.ok) {
+        setError(await readApiError(response, 'Could not invite the user.'));
+        return;
+      }
+      const body = (await response.json().catch(() => ({}))) as MutationResult;
+      showResult(body, 'Invitation created.');
+      form.reset();
+      setInviteRole('member');
+      await load();
+    } catch {
+      setError('Could not connect to the registry.');
+    } finally {
+      setPending(false);
+    }
+  };
+
+  const mutate = async (user: RegistryUser, action: 'resend' | 'role' | 'status', body: Record<string, string>, successMessage: string) => {
+    setPending(true);
+    setError(null);
+    setSuccess(null);
+    setManualLink(null);
+    try {
+      const response = await fetch(authApiUrl(`/api/admin/users/${encodeURIComponent(user.id)}/${action}`), {
+        method: 'POST',
+        credentials: 'include',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      if (!response.ok) {
+        setError(await readApiError(response, 'Could not update the user.'));
+        return;
+      }
+      const result = (await response.json().catch(() => ({}))) as MutationResult;
+      showResult(result, successMessage);
+      await load();
+    } catch {
+      setError('Could not connect to the registry.');
+    } finally {
+      setPending(false);
+    }
+  };
+
+  const copyLink = async () => {
+    if (!manualLink) return;
+    await navigator.clipboard.writeText(manualLink);
+    setCopied(true);
+    window.setTimeout(() => setCopied(false), 2000);
+  };
+
+  return (
+    <AccountLayout title="Users">
+      <div className="space-y-6">
+        <Card>
+          <CardHeader>
+            <CardTitle>Invite a user</CardTitle>
+            <CardDescription>
+              Email delivery is used when configured. Otherwise, the activation link appears once for manual delivery.
+            </CardDescription>
+          </CardHeader>
+          <form onSubmit={invite}>
+            <CardContent className="space-y-4">
+              {error ? (
+                <Alert variant="destructive">
+                  <AlertDescription>{error}</AlertDescription>
+                </Alert>
+              ) : null}
+              {success ? (
+                <Alert variant="green">
+                  <AlertDescription>{success}</AlertDescription>
+                </Alert>
+              ) : null}
+              {manualLink ? (
+                <Alert variant="warning">
+                  <MailPlus />
+                  <AlertTitle>Deliver this activation link securely</AlertTitle>
+                  <AlertDescription>
+                    <p className="mb-3">It is shown only in this response.</p>
+                    <div className="flex gap-2">
+                      <Input value={manualLink} readOnly className="text-xs" />
+                      <Button type="button" size="icon" variant="outline" onClick={() => void copyLink()} aria-label="Copy activation link">
+                        {copied ? <Check /> : <Copy />}
+                      </Button>
+                    </div>
+                  </AlertDescription>
+                </Alert>
+              ) : null}
+              <div className="grid gap-4 sm:grid-cols-3">
+                <div className="space-y-2">
+                  <Label htmlFor="invite-name">Display name</Label>
+                  <Input id="invite-name" name="name" required maxLength={100} placeholder="Alex Smith" />
+                </div>
+                <div className="space-y-2">
+                  <Label htmlFor="invite-email">Email</Label>
+                  <Input id="invite-email" name="email" type="email" required placeholder="colleague@company.com" />
+                </div>
+                <div className="space-y-2">
+                  <Label htmlFor="invite-role">Role</Label>
+                  <Select value={inviteRole} onValueChange={(value) => setInviteRole(value as typeof inviteRole)}>
+                    <SelectTrigger id="invite-role">
+                      <SelectValue />
+                    </SelectTrigger>
+                    <SelectContent>
+                      <SelectItem value="member">Member</SelectItem>
+                      <SelectItem value="admin">Administrator</SelectItem>
+                    </SelectContent>
+                  </Select>
+                </div>
+              </div>
+            </CardContent>
+            <CardFooter className="justify-end border-t px-6 py-4">
+              <Button type="submit" disabled={pending}>
+                <MailPlus />
+                {pending ? 'Inviting…' : 'Invite user'}
+              </Button>
+            </CardFooter>
+          </form>
+        </Card>
+
+        <Card>
+          <CardHeader>
+            <CardTitle>Registry users</CardTitle>
+            <CardDescription>
+              Manage roles and access. Deactivation preserves the user record and revokes their credentials.
+            </CardDescription>
+          </CardHeader>
+          <CardContent>
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead>User</TableHead>
+                  <TableHead>Role</TableHead>
+                  <TableHead>Status</TableHead>
+                  <TableHead className="text-right">Actions</TableHead>
+                </TableRow>
+              </TableHeader>
+              <TableBody>
+                {users.map((user) => (
+                  <TableRow key={user.id}>
+                    <TableCell>
+                      <p className="font-medium">{user.name || user.email}</p>
+                      <p className="text-xs text-muted-foreground">{user.email}</p>
+                    </TableCell>
+                    <TableCell>
+                      <Select
+                        value={user.role}
+                        disabled={pending}
+                        onValueChange={(role) => {
+                          if (role !== user.role) void mutate(user, 'role', { role }, `Updated ${user.email}.`);
+                        }}
+                      >
+                        <SelectTrigger className="w-36">
+                          <SelectValue />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value="member">Member</SelectItem>
+                          <SelectItem value="admin">Administrator</SelectItem>
+                        </SelectContent>
+                      </Select>
+                    </TableCell>
+                    <TableCell>
+                      <Badge variant={user.status === 'active' ? 'green' : user.status === 'deactivated' ? 'destructive' : 'warning'}>
+                        {user.status}
+                      </Badge>
+                    </TableCell>
+                    <TableCell>
+                      <div className="flex justify-end gap-2">
+                        {user.status === 'invited' ? (
+                          <Button
+                            size="sm"
+                            variant="ghost"
+                            disabled={pending}
+                            onClick={() => void mutate(user, 'resend', {}, `Invitation resent to ${user.email}.`)}
+                          >
+                            <RefreshCw /> Resend
+                          </Button>
+                        ) : null}
+                        {user.status !== 'invited' ? (
+                          <Button
+                            size="sm"
+                            variant="outline"
+                            disabled={pending || (user.id === currentUser?.id && user.status === 'active')}
+                            onClick={() => {
+                              const nextStatus = user.status === 'active' ? 'deactivated' : 'active';
+                              const message =
+                                nextStatus === 'active'
+                                  ? `Reactivate ${user.email}?`
+                                  : `Deactivate ${user.email} and revoke their credentials?`;
+                              if (window.confirm(message)) void mutate(user, 'status', { status: nextStatus }, `Updated ${user.email}.`);
+                            }}
+                          >
+                            {user.status === 'active' ? 'Deactivate' : 'Reactivate'}
+                          </Button>
+                        ) : null}
+                      </div>
+                    </TableCell>
+                  </TableRow>
+                ))}
+                {!users.length ? (
+                  <TableRow>
+                    <TableCell colSpan={4} className="py-8 text-center text-muted-foreground">
+                      No users found.
+                    </TableCell>
+                  </TableRow>
+                ) : null}
+              </TableBody>
+            </Table>
+          </CardContent>
+        </Card>
+      </div>
+    </AccountLayout>
+  );
+}

package/src/app/pages/api/account/index.ts

@@ -0,0 +1,26 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { buildGravatarUrl, updateRegistryUserProfile } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../lib/auth/api';
+
+export default async function accountHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['GET', 'PUT']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { auth: 'user', mutation: method === 'PUT' });
+  if (!context?.user) return;
+
+  if (method === 'GET') {
+    res.status(200).json({ user: context.user, gravatarUrl: buildGravatarUrl(context.user.email) });
+    return;
+  }
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const result = await updateRegistryUserProfile(context.db, {
+    userId: context.user.id,
+    name: typeof body.name === 'string' ? body.name : '',
+    image: typeof body.avatarUrl === 'string' ? body.avatarUrl : null,
+  });
+  if ('reason' in result) {
+    res.status(result.reason === 'not_found' ? 404 : 400).json({ error: 'Enter a valid display name and HTTPS avatar URL.' });
+    return;
+  }
+  res.status(200).json({ user: result.user });
+}

package/src/app/pages/api/account/tokens/[id].ts

@@ -0,0 +1,17 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { revokeRegistryAccessToken } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../../lib/auth/api';
+
+export default async function accountTokenHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['DELETE']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { auth: 'user', mutation: true });
+  if (!context?.user) return;
+  const tokenId = typeof req.query.id === 'string' ? req.query.id : '';
+  const revoked = await revokeRegistryAccessToken(context.db, { tokenId, userId: context.user.id });
+  if (!revoked) {
+    res.status(404).json({ error: 'Access token not found.' });
+    return;
+  }
+  res.status(200).json({ ok: true });
+}

package/src/app/pages/api/account/tokens/index.ts

@@ -0,0 +1,44 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import {
+  createRegistryAccessToken,
+  listRegistryAccessTokens,
+  REGISTRY_READ_SCOPE,
+  REGISTRY_WRITE_SCOPE,
+  type RegistryAccessScope,
+} from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../../lib/auth/api';
+
+const ONE_YEAR_MS = 365 * 24 * 60 * 60 * 1000;
+
+export default async function accountTokensHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['GET', 'POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { auth: 'user', mutation: method === 'POST' });
+  if (!context?.user) return;
+
+  if (method === 'GET') {
+    const tokens = await listRegistryAccessTokens(context.db, context.user.id);
+    res.status(200).json({ tokens });
+    return;
+  }
+
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const requested = Array.isArray(body.scopes) ? body.scopes : [];
+  const scopes = requested.filter(
+    (scope: unknown): scope is RegistryAccessScope => scope === REGISTRY_READ_SCOPE || scope === REGISTRY_WRITE_SCOPE
+  );
+  const normalizedScopes = scopes.includes(REGISTRY_WRITE_SCOPE) ? [REGISTRY_READ_SCOPE, REGISTRY_WRITE_SCOPE] : [REGISTRY_READ_SCOPE];
+  const result = await createRegistryAccessToken(context.db, {
+    userId: context.user.id,
+    name: typeof body.name === 'string' ? body.name : '',
+    scopes: normalizedScopes,
+    expiresAt: new Date(Date.now() + ONE_YEAR_MS),
+  });
+  if ('reason' in result) {
+    res.status(result.reason === 'scope_forbidden' ? 403 : 400).json({
+      error: result.reason === 'scope_forbidden' ? 'Only administrators can create write tokens.' : 'Enter a valid token name and scope.',
+    });
+    return;
+  }
+  res.status(201).json({ token: result.token, accessToken: result.token, record: result.record });
+}

package/src/app/pages/api/admin/users/[id]/[action].ts

@@ -0,0 +1,89 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { resendUserInvitation, setRegistryUserStatus, updateRegistryUserRole, type RegistryUserRole } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi, registryPageUrl } from '../../../../../lib/auth/api';
+import { registryEmailIsConfigured, sendRegistryAuthEmail } from '../../../../../lib/auth/email';
+
+const mutationError = (reason: string): { status: number; error: string } => {
+  if (reason === 'not_found') return { status: 404, error: 'User not found.' };
+  if (reason === 'last_admin') return { status: 409, error: 'The final active administrator cannot be changed.' };
+  if (reason === 'self_deactivation') return { status: 409, error: 'You cannot deactivate your own account.' };
+  return { status: 400, error: 'The requested user change is not valid.' };
+};
+
+export default async function userActionHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { auth: 'admin', mutation: true });
+  if (!context?.user) return;
+  const userId = typeof req.query.id === 'string' ? req.query.id : '';
+  const action = typeof req.query.action === 'string' ? req.query.action : '';
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+
+  if (action === 'role') {
+    if (body.role !== 'admin' && body.role !== 'member') {
+      res.status(400).json({ error: 'Role must be admin or member.' });
+      return;
+    }
+    const result = await updateRegistryUserRole(context.db, { userId, role: body.role as RegistryUserRole });
+    if ('reason' in result) {
+      const error = mutationError(result.reason);
+      res.status(error.status).json({ error: error.error });
+      return;
+    }
+    res.status(200).json({ user: result.user, message: 'User role updated.' });
+    return;
+  }
+
+  if (action === 'status') {
+    if (body.status !== 'active' && body.status !== 'deactivated') {
+      res.status(400).json({ error: 'Status must be active or deactivated.' });
+      return;
+    }
+    const result = await setRegistryUserStatus(context.db, {
+      userId,
+      status: body.status,
+      actorUserId: context.user.id,
+    });
+    if ('reason' in result) {
+      const error = mutationError(result.reason);
+      res.status(error.status).json({ error: error.error });
+      return;
+    }
+    res.status(200).json({ user: result.user, message: `User ${body.status}.` });
+    return;
+  }
+
+  if (action === 'resend') {
+    const result = await resendUserInvitation(context.db, { userId });
+    if ('reason' in result) {
+      const error = mutationError(result.reason);
+      res.status(error.status).json({ error: error.error });
+      return;
+    }
+    const activationUrl = registryPageUrl('/reset-password', undefined, { token: result.token, purpose: 'invite' });
+    if (!activationUrl) {
+      res.status(500).json({ error: 'AUTH_URL is not configured.' });
+      return;
+    }
+    if (registryEmailIsConfigured()) {
+      const delivered = await sendRegistryAuthEmail({
+        to: result.user.email,
+        subject: 'Your Handoff Registry invitation',
+        heading: 'You are invited',
+        message: 'Set a password to activate your Handoff Registry account.',
+        actionLabel: 'Accept invitation',
+        actionUrl: activationUrl,
+      });
+      if (!delivered) {
+        res.status(502).json({ error: 'The invitation was renewed, but email delivery failed.' });
+        return;
+      }
+      res.status(200).json({ user: result.user, message: 'Invitation resent.' });
+      return;
+    }
+    res.status(200).json({ user: result.user, message: 'Invitation renewed for manual delivery.', activationUrl });
+    return;
+  }
+
+  res.status(404).json({ error: 'Unknown user action.' });
+}

package/src/app/pages/api/admin/users/index.ts

@@ -0,0 +1,53 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { createUserInvitation, listRegistryUsers, type RegistryUserRole } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi, registryPageUrl } from '../../../../lib/auth/api';
+import { registryEmailIsConfigured, sendRegistryAuthEmail } from '../../../../lib/auth/email';
+
+export default async function usersHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['GET', 'POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { auth: 'admin', mutation: method === 'POST' });
+  if (!context?.user) return;
+
+  if (method === 'GET') {
+    res.status(200).json({ users: await listRegistryUsers(context.db) });
+    return;
+  }
+
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const role: RegistryUserRole = body.role === 'admin' ? 'admin' : 'member';
+  const result = await createUserInvitation(context.db, {
+    email: typeof body.email === 'string' ? body.email : '',
+    name: typeof body.name === 'string' ? body.name : '',
+    role,
+  });
+  if ('reason' in result) {
+    res.status(result.reason === 'email_exists' ? 409 : 400).json({
+      error: result.reason === 'email_exists' ? 'A user with this email already exists.' : 'Enter a valid email and display name.',
+    });
+    return;
+  }
+
+  const activationUrl = registryPageUrl('/reset-password', undefined, { token: result.token, purpose: 'invite' });
+  if (!activationUrl) {
+    res.status(500).json({ error: 'AUTH_URL is not configured.' });
+    return;
+  }
+  if (registryEmailIsConfigured()) {
+    const delivered = await sendRegistryAuthEmail({
+      to: result.user.email,
+      subject: 'Your Handoff Registry invitation',
+      heading: 'You are invited',
+      message: 'Set a password to activate your Handoff Registry account.',
+      actionLabel: 'Accept invitation',
+      actionUrl: activationUrl,
+    });
+    if (!delivered) {
+      res.status(502).json({ error: 'The invitation was created, but email delivery failed. Fix Resend configuration and resend it.' });
+      return;
+    }
+    res.status(201).json({ user: result.user, message: 'Invitation sent.' });
+    return;
+  }
+  res.status(201).json({ user: result.user, message: 'Invitation created for manual delivery.', activationUrl });
+}

package/src/app/pages/api/auth/[...nextauth].ts

@@ -0,0 +1,4 @@
+import NextAuth from 'next-auth';
+import { registryAuthOptions } from '../../../lib/auth/config';
+
+export default NextAuth(registryAuthOptions);

package/src/app/pages/api/auth/request-reset.ts

@@ -0,0 +1,53 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { consumeAuthRateLimit, createPasswordReset, normalizeEmail } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi, registryPageUrl } from '../../../lib/auth/api';
+import { registryEmailIsConfigured, sendRegistryAuthEmail } from '../../../lib/auth/email';
+
+const requestAddress = (req: NextApiRequest): string => {
+  const forwarded = req.headers['x-forwarded-for'];
+  return (Array.isArray(forwarded) ? forwarded[0] : forwarded)?.split(',')[0]?.trim() || req.socket.remoteAddress || 'unknown';
+};
+
+export default async function requestResetHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { mutation: true });
+  if (!context) return;
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const email = normalizeEmail(typeof body.email === 'string' ? body.email : '');
+  const throttle = await consumeAuthRateLimit(context.db, {
+    bucket: 'password_reset',
+    identifier: `${requestAddress(req)}:${email}`,
+    limit: 5,
+    windowMs: 60 * 60 * 1000,
+  });
+  if (!throttle.allowed) {
+    res.setHeader('Retry-After', String(throttle.retryAfterSeconds));
+    res.status(429).json({ error: 'Too many reset requests. Try again later.' });
+    return;
+  }
+
+  if (!registryEmailIsConfigured()) {
+    res.status(200).json({ ok: true });
+    return;
+  }
+  const result = await createPasswordReset(context.db, email);
+  if (result.token && result.user) {
+    const resetUrl = registryPageUrl('/reset-password', undefined, { token: result.token });
+    if (resetUrl) {
+      try {
+        await sendRegistryAuthEmail({
+          to: result.user.email,
+          subject: 'Reset your Handoff Registry password',
+          heading: 'Reset your password',
+          message: 'Use this single-use link to choose a new password.',
+          actionLabel: 'Reset password',
+          actionUrl: resetUrl,
+        });
+      } catch {
+        // Keep the response enumeration-safe. Operational email failures never reveal account state.
+      }
+    }
+  }
+  res.status(200).json({ ok: true });
+}

package/src/app/pages/api/auth/reset-password.ts

@@ -0,0 +1,29 @@
+import type { NextApiRequest, NextApiResponse } from 'next';
+import { acceptUserInvitation, resetPassword } from '@handoff/registry/auth';
+import { allowApiMethods, prepareRegistryApi } from '../../../lib/auth/api';
+
+export default async function resetPasswordHandler(req: NextApiRequest, res: NextApiResponse) {
+  const method = allowApiMethods(req, res, ['POST']);
+  if (!method) return;
+  const context = await prepareRegistryApi(req, res, { mutation: true });
+  if (!context) return;
+  const body = req.body && typeof req.body === 'object' ? req.body : {};
+  const token = typeof body.token === 'string' ? body.token : '';
+  const password = typeof body.password === 'string' ? body.password : '';
+  if (password !== body.passwordConfirmation) {
+    res.status(400).json({ error: 'Passwords do not match.' });
+    return;
+  }
+  const result =
+    body.purpose === 'invite'
+      ? await acceptUserInvitation(context.db, { token, password })
+      : await resetPassword(context.db, { token, password });
+  if ('reason' in result) {
+    res.status(400).json({
+      error:
+        result.reason === 'invalid_password' && result.error ? result.error : 'This link is invalid, expired, or has already been used.',
+    });
+    return;
+  }
+  res.status(200).json({ ok: true });
+}