crumbs/src/routes/api/admin/users/+server.ts

import { json, error } from '@sveltejs/kit';
import type { RequestHandler } from './$types.js';
import { requireAdmin } from '$lib/server/api-utils.js';
import { listUsers, createUser } from '$lib/server/auth.js';
import { isEmailConfigured, sendWelcomeEmail } from '$lib/server/email.js';

export const GET: RequestHandler = async (event) => {
	requireAdmin(event);
	return json(listUsers());
};

export const POST: RequestHandler = async ({ request, ...event }) => {
	requireAdmin(event);
	const { email, displayName, password, role } = await request.json();

	if (!email) {
		throw error(400, 'Email is required');
	}

	if (password && password.length < 8) {
		throw error(400, 'Password must be at least 8 characters');
	}

	const user = await createUser(email, displayName || email.split('@')[0], password || null, role || 'user');

	// Send welcome email (fire-and-forget)
	if (isEmailConfigured() && user.email) {
		const origin = process.env.ORIGIN || 'http://localhost:3000';
		sendWelcomeEmail(user.email, user.displayName, origin).catch(() => {});
	}

	return json(user, { status: 201 });
};