KI-AGENT: Passwort-Reset im Admin-Dashboard ergänzen

backend/src/routes/admin.ts

@@ -10,6 +10,7 @@ import { pipeline } from "node:stream/promises";
 import {
     authTenantUsers,
     authProfiles,
+    authRefreshTokens,
     customers,
     authRoles,
     authUserRoles,
@@ -1257,6 +1258,64 @@ export default async function adminRoutes(server: FastifyInstance) {
         }
     });
 
+    // -------------------------------------------------------------
+    // POST /admin/users/:user_id/reset-password
+    // -------------------------------------------------------------
+    server.post("/admin/users/:user_id/reset-password", async (req, reply) => {
+        try {
+            const currentUser = await requireAdmin(req, reply);
+            if (!currentUser) return;
+
+            const { user_id } = req.params as { user_id: string };
+            const body = (req.body || {}) as { password?: string };
+            const requestedPassword = body.password?.trim();
+
+            if (requestedPassword && requestedPassword.length < 8) {
+                return reply.code(400).send({ error: "Password must contain at least 8 characters" });
+            }
+
+            const initialPassword = requestedPassword || generateRandomPassword(14);
+            const passwordHash = await hashPassword(initialPassword);
+
+            const updatedUser = await server.db.transaction(async (tx) => {
+                const [user] = await tx
+                    .update(authUsers)
+                    .set({
+                        passwordHash,
+                        must_change_password: true,
+                        updatedAt: new Date(),
+                    })
+                    .where(eq(authUsers.id, user_id))
+                    .returning({
+                        id: authUsers.id,
+                        email: authUsers.email,
+                        must_change_password: authUsers.must_change_password,
+                    });
+
+                if (user) {
+                    await tx
+                        .update(authRefreshTokens)
+                        .set({ revokedAt: new Date() })
+                        .where(eq(authRefreshTokens.userId, user_id));
+                }
+
+                return user;
+            });
+
+            if (!updatedUser) {
+                return reply.code(404).send({ error: "User not found" });
+            }
+
+            return {
+                user: updatedUser,
+                initialPassword,
+            };
+        } catch (err) {
+            console.error("ERROR /admin/users/:user_id/reset-password:", err);
+            return reply.code(500).send({ error: "Internal Server Error" });
+        }
+    });
+
     // -------------------------------------------------------------
     // PUT /admin/tenants/:tenant_id
     // -------------------------------------------------------------