import { connectDB } from "@/lib/db"; import { User, PasswordReset } from "@/models"; import { successResponse } from "@/lib/api/response"; import { ValidationError } from "@/lib/api/errors"; import { Types } from "mongoose"; import { sendEmail } from "@/lib/email"; import { getSettings } from "@/models/settings.model"; import { defaultLocale, isValidLocale } from "@/config/i18n.config"; import { DEFAULT_PRIMARY_COLOR, DEFAULT_STORE_NAME, } from "@/config/branding.config"; import { STAFF_USER_ROLES } from "@/lib/staff-role"; import { withApi } from "@/lib/api/handler"; type PasswordResetModelWithCreateToken = { createToken: (userId: unknown) => Promise<{ token: string }>; }; /** * POST /api/admin/staff/[id]/invite * Send an invite email to a staff member to set their password */ export const POST = withApi<{ id: string }>( { auth: "admin", rateLimit: { action: "admin:staff:invite", preset: "moderate" }, }, async ({ request, params }) => { const { id } = params; if (!Types.ObjectId.isValid(id)) { throw new ValidationError("Invalid staff member ID"); } await connectDB(); const user = await User.findOne({ _id: id, role: { $in: STAFF_USER_ROLES }, }).lean(); if (!user) { throw new ValidationError("Staff member not found"); } // Check email is configured const settings = await getSettings(); if (!settings.email?.enabled) { throw new ValidationError( "Email is not configured. Please configure SMTP settings first.", ); } // Create a password reset token (valid for 1 hour for invites) const passwordResetModel = PasswordReset as unknown as PasswordResetModelWithCreateToken; const { token } = await passwordResetModel.createToken(user._id); // Build invite URL const localeParam = request.nextUrl.searchParams.get("locale"); const inviteLocale = localeParam && isValidLocale(localeParam) ? localeParam : defaultLocale; const appUrl = process.env.NEXT_PUBLIC_APP_URL || "http://localhost:3000"; const inviteUrl = `${appUrl}/${inviteLocale}/reset-password?token=${token}&invite=true`; const storeName = settings.general?.storeName || DEFAULT_STORE_NAME; // Send invite email const emailSent = await sendEmail({ to: user.email, subject: `You've been invited to join ${storeName} as staff`, html: staffInviteTemplate({ name: user.name || "there", storeName, inviteUrl, }), settings, }); if (!emailSent) { throw new ValidationError( "Failed to send invite email. Please check your SMTP settings.", ); } return successResponse({ message: `Invite email sent to ${user.email}`, }); }, ); function staffInviteTemplate({ name, storeName, inviteUrl, }: { name: string; storeName: string; inviteUrl: string; }) { return `

${storeName}

You're invited!

Hi ${name},

You've been invited to join ${storeName} as a staff member. To get started, please set up your password by clicking the button below.

Set Your Password

Or copy and paste this link into your browser:

${inviteUrl}

This link will expire in 1 hour. If it expires, ask your admin to send a new invite.

If you didn't expect this invitation, you can safely ignore this email.

`; }