Add admin dashboard account provisioning

src/server/app.ts

@@ -6,6 +6,7 @@ import submitRouter from './routes/submit';
 import internalRouter from './routes/internal';
 import reportsRouter from './routes/reports';
 import accountsRouter from './routes/accounts';
+import adminUsersRouter from './routes/admin-users';
 
 /**
  * Create and configure the Express application with all routes and middleware.
@@ -47,6 +48,7 @@ export function createApp(): Express {
   app.use(submitRouter);
   app.use(reportsRouter);
   app.use(accountsRouter);
+  app.use(adminUsersRouter);
   app.use(internalRouter);
 
   app.use((req: Request, res: Response) => {

src/server/routes/admin-users.ts

@@ -0,0 +1,120 @@
+import { Router, Response } from 'express';
+import { supabase } from '../../db/client';
+import { logger } from '../../utils/logger';
+import { authenticateUser, AuthenticatedRequest } from '../middleware/auth';
+
+const router = Router();
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const ALLOWED_ROLES = new Set(['user', 'admin']);
+
+async function isAdmin(userId: string): Promise<boolean> {
+  const { data, error } = await supabase
+    .from('user_profiles')
+    .select('role')
+    .eq('id', userId)
+    .single();
+
+  if (error) {
+    logger.warn('Failed to verify admin for user management', {
+      userId,
+      error: error.message,
+    });
+    return false;
+  }
+
+  return data?.role === 'admin';
+}
+
+router.post(
+  '/api/admin/users',
+  authenticateUser,
+  async (req, res: Response): Promise<void> => {
+    const authReq = req as AuthenticatedRequest;
+
+    try {
+      if (!(await isAdmin(authReq.userId))) {
+        res.status(403).json({ error: 'Admin access required' });
+        return;
+      }
+
+      const email = String(authReq.body.email || '').trim().toLowerCase();
+      const password = String(authReq.body.password || '');
+      const displayName = String(authReq.body.displayName || '').trim();
+      const role = String(authReq.body.role || 'user').trim().toLowerCase();
+      const ticketBalance = Number(authReq.body.ticketBalance ?? 0);
+
+      if (!EMAIL_PATTERN.test(email)) {
+        res.status(400).json({ error: 'A valid email address is required' });
+        return;
+      }
+      if (password.length < 8 || password.length > 128) {
+        res.status(400).json({ error: 'Password must contain 8 to 128 characters' });
+        return;
+      }
+      if (displayName.length > 80) {
+        res.status(400).json({ error: 'Display name must not exceed 80 characters' });
+        return;
+      }
+      if (!ALLOWED_ROLES.has(role)) {
+        res.status(400).json({ error: 'Role must be user or admin' });
+        return;
+      }
+      if (!Number.isInteger(ticketBalance) || ticketBalance < 0 || ticketBalance > 1_000_000) {
+        res.status(400).json({ error: 'Ticket balance must be an integer from 0 to 1,000,000' });
+        return;
+      }
+
+      const { data: created, error: createError } = await supabase.auth.admin.createUser({
+        email,
+        password,
+        email_confirm: true,
+        user_metadata: {
+          display_name: displayName || email.split('@')[0],
+        },
+      });
+
+      if (createError || !created.user) {
+        const message = createError?.message || 'Supabase did not return the created user';
+        const status = /already|registered|exists/i.test(message) ? 409 : 400;
+        res.status(status).json({ error: message });
+        return;
+      }
+
+      const { data: profile, error: profileError } = await supabase
+        .from('user_profiles')
+        .update({
+          display_name: displayName || email.split('@')[0],
+          role,
+          ticket_balance: ticketBalance,
+          updated_at: new Date().toISOString(),
+        })
+        .eq('id', created.user.id)
+        .select('id, email, display_name, role, ticket_balance, created_at')
+        .single();
+
+      if (profileError || !profile) {
+        await supabase.auth.admin.deleteUser(created.user.id).catch(() => undefined);
+        throw profileError || new Error('User profile was not created');
+      }
+
+      logger.info('Dashboard account created by admin', {
+        adminUserId: authReq.userId,
+        createdUserId: created.user.id,
+        role,
+        ticketBalance,
+      });
+
+      res.status(201).json({ user: profile });
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : String(error);
+      logger.error('Admin user creation failed', {
+        adminUserId: authReq.userId,
+        error: message,
+      });
+      res.status(500).json({ error: 'Failed to create dashboard account' });
+    }
+  },
+);
+
+export default router;