feat: restrict non credential provider interactions (#871)

* wip: add provider field to sqlite user table

* feat: disable invites when credentials provider is not used

* wip: add migration for provider field in user table with sqlite

* wip: remove fields that can not be modified by non credential users

* wip: make username, mail and avatar disabled instead of hidden

* wip: external users membership of group cannot be managed manually

* feat: add alerts to inform about disabled fields and managing group members

* wip: add mysql migration for provider on user table

* chore: fix format issues

* chore: address pull request feedback

* fix: build issue

* fix: deepsource issues

* fix: tests not working

* feat: restrict login to specific auth providers

* chore: address pull request feedback

* fix: deepsource issue

packages/api/src/router/invite.ts

@@ -6,9 +6,11 @@ import { invites } from "@homarr/db/schema/sqlite";
 import { z } from "@homarr/validation";
 
 import { createTRPCRouter, protectedProcedure } from "../trpc";
+import { throwIfCredentialsDisabled } from "./invite/checks";
 
 export const inviteRouter = createTRPCRouter({
   getAll: protectedProcedure.query(async ({ ctx }) => {
+    throwIfCredentialsDisabled();
     const dbInvites = await ctx.db.query.invites.findMany({
       orderBy: asc(invites.expirationDate),
       columns: {
@@ -32,6 +34,7 @@ export const inviteRouter = createTRPCRouter({
       }),
     )
     .mutation(async ({ ctx, input }) => {
+      throwIfCredentialsDisabled();
       const id = createId();
       const token = randomBytes(20).toString("hex");
 
@@ -54,6 +57,7 @@ export const inviteRouter = createTRPCRouter({
       }),
     )
     .mutation(async ({ ctx, input }) => {
+      throwIfCredentialsDisabled();
       const dbInvite = await ctx.db.query.invites.findFirst({
         where: eq(invites.id, input.id),
       });