admin / Synapse-Sonar

import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import bcrypt from "bcryptjs";
import { prisma } from "@/lib/prisma";

export const runtime = "nodejs";

/**
 * Invite acceptance — public (token-authenticated) flow.
 *
 *   GET  /api/invite/:token  → validate token, return display info for the page.
 *   POST /api/invite/:token  → set password + activate the account.
 *
 * The single-use invite token (created by POST /api/users) is the only
 * credential here; it is consumed (nulled) on successful acceptance.
 */

const ROLE_LABEL: Record<string, string> = {
  TENANT_ADMIN: "Tenant Admin",
  SECURITY_ANALYST: "Security Analyst",
  READ_ONLY_VIEWER: "Read-Only Viewer",
};

export async function GET(
  _req: NextRequest,
  { params }: { params: { token: string } }
) {
  const user = await prisma.user.findUnique({
    where: { inviteToken: params.token },
    include: { tenant: { select: { name: true, slug: true } } },
  });

  if (!user || user.status !== "INVITED") {
    return NextResponse.json(
      { error: "This invitation is invalid or has already been used." },
      { status: 404 }
    );
  }

  return NextResponse.json({
    username: user.username,
    name: user.name ?? "",
    roleLabel: ROLE_LABEL[user.role] ?? user.role,
    tenantName: user.tenant.name,
  });
}

const AcceptSchema = z.object({
  name: z.string().min(1).max(80).optional(),
  password: z.string().min(10, "Use at least 10 characters"),
});

export async function POST(
  req: NextRequest,
  { params }: { params: { token: string } }
) {
  let body;
  try {
    body = AcceptSchema.parse(await req.json());
  } catch (err) {
    if (err instanceof z.ZodError) {
      return NextResponse.json(
        { error: "Invalid input", details: err.issues },
        { status: 422 }
      );
    }
    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
  }

  const user = await prisma.user.findUnique({
    where: { inviteToken: params.token },
  });

  if (!user || user.status !== "INVITED") {
    return NextResponse.json(
      { error: "This invitation is invalid or has already been used." },
      { status: 404 }
    );
  }

  // Consume the token, set credentials, activate. updateMany with the token
  // guard makes this idempotent-safe against a double submit.
  const result = await prisma.user.updateMany({
    where: { id: user.id, inviteToken: params.token, status: "INVITED" },
    data: {
      passwordHash: await bcrypt.hash(body.password, 12),
      status: "ACTIVE",
      inviteToken: null,
      ...(body.name ? { name: body.name } : {}),
    },
  });

  if (result.count === 0) {
    return NextResponse.json(
      { error: "This invitation is invalid or has already been used." },
      { status: 409 }
    );
  }

  return NextResponse.json({ ok: true, username: user.username });
}