OPS_GROUPS.includes(g)) : ['sysadmin']
+ const roles = Array.isArray(body.roles) && body.roles.length ? body.roles : ['Employee']
+ if (!email || !fullName) return json(res, 400, { error: 'email + full_name required' })
+ if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) return json(res, 400, { error: 'invalid email' })
+
+ // 1a. Pre-flight: did this user already exist on either side? Don't
+ // fail outright — the dispatcher might be re-inviting somebody
+ // after a botched first try; re-send the recovery + re-create
+ // ERPNext record if missing.
+ const existing = await akFetch('/core/users/?search=' + encodeURIComponent(email) + '&page_size=5')
+ let akUser = existing.data?.results?.find(u => u.email?.toLowerCase() === email)
+
+ // 1b. Username derivation — Authentik usernames are commonly the
+ // local part of the email; collisions get a numeric suffix.
+ const baseUser = email.split('@')[0].replace(/[^a-z0-9._-]/gi, '').toLowerCase() || 'user'
+ let username = baseUser
+ if (!akUser) {
+ let suffix = 0
+ // eslint-disable-next-line no-constant-condition
+ while (true) {
+ const probe = await akFetch('/core/users/?username=' + encodeURIComponent(username))
+ if (!probe.data?.results?.length) break
+ suffix++; username = baseUser + suffix
+ if (suffix > 50) return json(res, 500, { error: 'Could not allocate Authentik username' })
+ }
+ }
+
+ // 1c. Resolve requested group names → Authentik group PKs.
+ const allGroups = await fetchGroups()
+ const groupPks = requestedGroups
+ .map(name => allGroups.find(g => g.name === name)?.pk)
+ .filter(Boolean)
+
+ // 1d. Create OR patch the Authentik user. Always end with the requested
+ // groups attached; resetting if necessary keeps the call idempotent.
+ if (!akUser) {
+ const create = await akFetch('/core/users/', 'POST', {
+ username, name: fullName, email,
+ is_active: true, groups: groupPks, attributes: {},
+ })
+ if (create.status >= 400) {
+ log('Authentik user create failed:', create.status, JSON.stringify(create.data))
+ return json(res, 502, { error: 'Authentik create failed', detail: create.data })
+ }
+ akUser = create.data
+ } else {
+ const patch = await akFetch('/core/users/' + akUser.pk + '/', 'PATCH', {
+ name: fullName, is_active: true, groups: groupPks,
+ })
+ if (patch.status !== 200) {
+ log('Authentik user patch failed:', patch.status, JSON.stringify(patch.data))
+ } else {
+ akUser = patch.data
+ }
+ }
+
+ // 1e. Trigger a recovery email — Authentik mails the user a one-time
+ // link so they set their own password. Only effective if the
+ // `Email` stage is configured globally in the recovery flow.
+ let recoveryUrl = null
+ try {
+ const rec = await akFetch('/core/users/' + akUser.pk + '/recovery_email/', 'POST', {})
+ if (rec.status >= 400) {
+ // Fallback: get a recovery URL we can hand back to the admin
+ // (e.g. to send via SMS or Slack ourselves).
+ const link = await akFetch('/core/users/' + akUser.pk + '/recovery/', 'POST', {})
+ if (link.status === 200) recoveryUrl = link.data?.link || null
+ }
+ } catch (e) { log('recovery email failed:', e.message) }
+
+ // 2. Create the matching ERPNext User. Frappe wants `roles` as a child
+ // table of {role: } rows; the Authentik OAuth2 login
+ // matches by `email` so this record is what gets logged in to.
+ let erpResult = null
+ try {
+ // Skip if already exists.
+ const probe = await erpFetch('/api/resource/User/' + encodeURIComponent(email))
+ if (probe.status === 200) {
+ erpResult = { ok: true, existing: true, name: email }
+ } else {
+ const erpBody = {
+ email, first_name: fullName.split(' ')[0],
+ last_name: fullName.split(' ').slice(1).join(' '),
+ full_name: fullName,
+ user_type: 'System User', enabled: 1,
+ send_welcome_email: 1,
+ roles: roles.map(r => ({ role: r })),
+ social_logins: [{ provider: 'authentik', userid: email }],
+ }
+ const create = await erpFetch('/api/resource/User', { method: 'POST', body: JSON.stringify(erpBody) })
+ if (create.status >= 400) {
+ log('ERPNext User create failed:', create.status, JSON.stringify(create.data).slice(0, 400))
+ erpResult = { ok: false, error: 'ERPNext create failed: ' + create.status }
+ } else {
+ erpResult = { ok: true, existing: false, name: create.data?.data?.name || email }
+ }
+ }
+ } catch (e) { log('ERPNext User flow failed:', e.message); erpResult = { ok: false, error: e.message } }
+
+ log(`Auth: invited ${email} (groups=[${requestedGroups.join(',')}], erp=${erpResult?.ok ? 'ok' : 'failed'})`)
+ return json(res, 200, {
+ ok: true,
+ user: {
+ pk: akUser.pk, username: akUser.username, email: akUser.email, name: akUser.name,
+ is_active: akUser.is_active, groups: requestedGroups, overrides: {},
+ },
+ erpnext: erpResult,
+ recovery_url: recoveryUrl,
+ })
+ }
+
if (resource === 'sync-legacy' && method === 'POST') {
if (!mysql) return json(res, 503, { error: 'mysql2 not installed' })