0ead1385f7
Creating an invite previously meant writing SQL by hand, which made the whole feature unusable in practice. The owner can now create invites with a use count and expiry, copy the link, show a QR code, and revoke. QR codes are generated locally by node-qrcode as inline SVG. The CSP forbids loading from any other origin, so an external generator was not an option, and img-src 'self' already covers a same-origin SVG. People lists everyone with what they have added and what their AI use has cost over 30 days, with suspend, reactivate, per-user AI toggle and delete. Deleting collects image keys and the minted gateway key id before the cascade removes the rows, then cleans both up best-effort - storage or the gateway being unavailable must not leave an account half-deleted. Guards refuse to suspend or delete yourself or the last owner. Password reset links close the gap that came with keeping email and password sign-in: with no email infrastructure, a member who forgets their password had no way back in and the owner had no way to help. The owner generates a single-use 24 hour link and delivers it the same way as an invite. Issuing one invalidates any earlier unused reset, and the reset endpoint answers identically for unknown, used and expired tokens so it cannot be used to probe which exist. The admin area 404s for members rather than 403ing, so its existence is not advertised, and every /api/admin handler independently requires the owner role. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
46 lines
1.1 KiB
JSON
46 lines
1.1 KiB
JSON
{
|
|
"name": "drinktracker-init",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "next dev --experimental-https",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "next lint"
|
|
},
|
|
"dependencies": {
|
|
"@auth/prisma-adapter": "^2.11.1",
|
|
"@aws-sdk/client-s3": "^3.1000.0",
|
|
"@prisma/client": "^6.19.2",
|
|
"@tanstack/react-query": "^5.90.21",
|
|
"@types/bcryptjs": "^2.4.6",
|
|
"bcryptjs": "^3.0.3",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"html5-qrcode": "^2.3.8",
|
|
"lucide-react": "^0.575.0",
|
|
"next": "14.2.35",
|
|
"next-auth": "^5.0.0-beta.25",
|
|
"openai": "^6.25.0",
|
|
"prisma": "^6.19.2",
|
|
"qrcode": "^1.5.4",
|
|
"react": "^18",
|
|
"react-dom": "^18",
|
|
"sharp": "^0.34.5",
|
|
"tailwind-merge": "^3.5.0",
|
|
"tailwindcss-animate": "^1.0.7",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@types/react": "^18",
|
|
"@types/react-dom": "^18",
|
|
"eslint": "^8",
|
|
"eslint-config-next": "14.2.35",
|
|
"postcss": "^8",
|
|
"tailwindcss": "^3.4.1",
|
|
"typescript": "^5"
|
|
}
|
|
}
|