feat : 6 astra improve it

app/admin/register/actions.ts

@@ -8,6 +8,7 @@ import { z } from "zod";
 import { getDb } from "@/db";
 import { users } from "@/db/schema";
 import { getAuth, requireAdmin } from "@/lib/auth/server";
+import { securityLog } from "@/lib/security/http";
 
 export interface CreateAccountState {
   status: "idle" | "error" | "success";
@@ -16,9 +17,9 @@ export interface CreateAccountState {
 
 const accountSchema = z
   .object({
-    name: z.string().trim().min(1),
+    name: z.string().trim().min(1).max(100),
     email: z.email().transform((value) => value.toLowerCase()),
-    password: z.string().min(8).max(128),
+    password: z.string().min(12).max(128),
     passwordConfirmation: z.string(),
   })
   .refine((data) => data.password === data.passwordConfirmation, {
@@ -29,7 +30,7 @@ export async function createAccount(
   _previousState: CreateAccountState,
   formData: FormData,
 ): Promise<CreateAccountState> {
-  await requireAdmin();
+  const admin = await requireAdmin();
   const parsed = accountSchema.safeParse(Object.fromEntries(formData));
   if (!parsed.success) {
     return { status: "error", message: "โปรดตรวจสอบชื่อ อีเมล และรหัสผ่านให้ถูกต้อง" };
@@ -49,6 +50,8 @@ export async function createAccount(
         name: parsed.data.name,
         email: parsed.data.email,
         password: parsed.data.password,
+        role: "admin",
+        data: { emailVerified: true },
       },
       headers: await headers(),
     });
@@ -57,6 +60,7 @@ export async function createAccount(
   }
 
   revalidatePath("/admin/register");
+  securityLog("account-created", { actorId: admin.user.id });
   return { status: "success", message: `สร้างบัญชี ${parsed.data.email} แล้ว` };
 }
 
@@ -64,6 +68,9 @@ export async function removeAccount(
   userId: string,
 ): Promise<{ status: "error" | "success"; message?: string }> {
   const session = await requireAdmin();
+  if (!z.string().min(1).max(128).safeParse(userId).success) {
+    return { status: "error", message: "บัญชีไม่ถูกต้อง" };
+  }
   if (userId === session.user.id) {
     return { status: "error", message: "ไม่สามารถลบบัญชีที่กำลังใช้งานอยู่" };
   }
@@ -78,5 +85,6 @@ export async function removeAccount(
   }
 
   revalidatePath("/admin/register");
+  securityLog("account-removed", { actorId: session.user.id, targetId: userId });
   return { status: "success" };
 }