feat(admin): provision a user with an emailed password reset instead of a set password

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.test.tsx

@@ -267,6 +267,47 @@ describe('AddUserModal', () => {
     })
   })
 
+  it('drops the password field and submits without one when emailing a reset link', async () => {
+    mockMutate.mockImplementation(
+      (_input: AddUserInput, options: { onSuccess: (user: AdminUser) => void }) => {
+        options.onSuccess(CREATED_USER)
+      }
+    )
+    await renderModal()
+    await changeField('Name', 'Canary Writer')
+    await changeField('Email', 'writer@synthetics.example.com')
+    await changeField('Credentials', 'email')
+
+    expect(container.querySelector('[aria-label="Password"]')).toBeNull()
+    expect(buttonLabelled('Add user').disabled).toBe(false)
+
+    await act(async () => {
+      buttonLabelled('Add user').dispatchEvent(new MouseEvent('click', { bubbles: true }))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    expect(mockMutate).toHaveBeenCalledWith(
+      {
+        name: 'Canary Writer',
+        email: 'writer@synthetics.example.com',
+        emailVerified: true,
+      },
+      { onSuccess: expect.any(Function), onSettled: expect.any(Function) }
+    )
+    expect(onCreated).toHaveBeenCalledWith(CREATED_USER)
+  })
+
+  it('keeps a typed password across a round trip through the reset-link flow', async () => {
+    await renderModal()
+    await fillRequiredFields()
+    await changeField('Credentials', 'email')
+    await changeField('Credentials', 'set')
+
+    expect((field('Password') as HTMLInputElement).value).toBe('canary-password')
+    expect(buttonLabelled('Add user').disabled).toBe(false)
+  })
+
   it('shows Better Auth failures without closing the modal', async () => {
     addUserMutation.current = {
       isPending: false,

apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.tsx

@@ -18,6 +18,13 @@ const EMAIL_STATUS_OPTIONS = [
   { value: 'unverified', label: 'Unverified' },
 ] as const
 
+const PASSWORD_MODE_OPTIONS = [
+  { value: 'set', label: 'Set a password' },
+  { value: 'email', label: 'Email a reset link' },
+] as const
+
+type PasswordMode = (typeof PASSWORD_MODE_OPTIONS)[number]['value']
+
 interface AddUserModalProps {
   open: boolean
   onOpenChange: (open: boolean) => void
@@ -30,9 +37,11 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
   const [isSubmitting, setIsSubmitting] = useState(false)
   const [name, setName] = useState('')
   const [email, setEmail] = useState('')
+  const [passwordMode, setPasswordMode] = useState<PasswordMode>('set')
   const [password, setPassword] = useState('')
   const [emailVerified, setEmailVerified] = useState(true)
 
+  const setsPassword = passwordMode === 'set'
   const normalizedName = name.trim()
   const normalizedEmail = email.trim().toLowerCase()
   const nameError = name.length > 0 && !normalizedName ? 'Name is required' : undefined
@@ -46,12 +55,13 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
   const canSubmit =
     normalizedName.length > 0 &&
     isValidEmailSyntax(normalizedEmail) &&
-    password.length >= 8 &&
+    (!setsPassword || password.length >= 8) &&
     !isSubmissionPending
 
   const reset = () => {
     setName('')
     setEmail('')
+    setPasswordMode('set')
     setPassword('')
     setEmailVerified(true)
     addUser.reset()
@@ -72,8 +82,8 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
       {
         name: normalizedName,
         email: normalizedEmail,
-        password,
         emailVerified,
+        ...(setsPassword ? { password } : {}),
       },
       {
         onSuccess: (user) => {
@@ -131,21 +141,38 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
           required
         />
         <ChipModalField
-          type='input'
-          inputType='password'
-          title='Password'
-          value={password}
+          type='dropdown'
+          title='Credentials'
+          value={passwordMode}
           onChange={(value) => {
-            setPassword(value)
+            setPasswordMode(value as PasswordMode)
             addUser.reset()
           }}
-          error={passwordError}
-          hint='Better Auth creates a credential account with this password.'
-          placeholder='At least 8 characters'
-          autoComplete='new-password'
+          options={PASSWORD_MODE_OPTIONS}
+          align='start'
+          hint={
+            setsPassword ? undefined : 'They pick their own password from the emailed reset link.'
+          }
           disabled={isSubmissionPending}
           required
         />
+        {setsPassword && (
+          <ChipModalField
+            type='input'
+            inputType='password'
+            title='Password'
+            value={password}
+            onChange={(value) => {
+              setPassword(value)
+              addUser.reset()
+            }}
+            error={passwordError}
+            placeholder='At least 8 characters'
+            autoComplete='new-password'
+            disabled={isSubmissionPending}
+            required
+          />
+        )}
         <ChipModalField
           type='dropdown'
           title='Email status'

apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx

@@ -21,6 +21,7 @@ import {
   useAdminUsersByEmails,
   useBanUser,
   useImpersonateUser,
+  useSendPasswordReset,
   useSetUserRole,
   useUnbanUser,
 } from '@/hooks/queries/admin-users'
@@ -36,7 +37,7 @@ const USER_TABLE_HEADER = (
     <span className='flex-1'>Email</span>
     <span className='w-[60px]'>Role</span>
     <span className='w-[55px]'>Status</span>
-    <span className='w-[200px] text-right'>Actions</span>
+    <span className='w-[300px] text-right'>Actions</span>
   </div>
 )
 
@@ -58,6 +59,7 @@ export function Admin() {
   const banUser = useBanUser()
   const unbanUser = useUnbanUser()
   const impersonateUser = useImpersonateUser()
+  const sendPasswordReset = useSendPasswordReset()
   const { recentEmails, recordImpersonation } = useRecentImpersonations()
   const { data: recentUsers } = useAdminUsersByEmails(recentEmails)
 
@@ -162,6 +164,8 @@ export function Admin() {
       ids.add((unbanUser.variables as { userId: string }).userId)
     if (impersonateUser.isPending && (impersonateUser.variables as { userId?: string })?.userId)
       ids.add((impersonateUser.variables as { userId: string }).userId)
+    if (sendPasswordReset.isPending && sendPasswordReset.variables?.userId)
+      ids.add(sendPasswordReset.variables.userId)
     if (impersonatingUserId) ids.add(impersonatingUserId)
     return ids
   }, [
@@ -173,9 +177,19 @@ export function Admin() {
     unbanUser.variables,
     impersonateUser.isPending,
     impersonateUser.variables,
+    sendPasswordReset.isPending,
+    sendPasswordReset.variables,
     impersonatingUserId,
   ])
 
+  /** Confirms the send in place, since nothing about the user row changes. */
+  const resetPasswordLabel = (userId: string) => {
+    if (sendPasswordReset.variables?.userId !== userId) return 'Reset password'
+    if (sendPasswordReset.isPending) return 'Sending...'
+    if (sendPasswordReset.isSuccess) return 'Reset sent'
+    return 'Reset password'
+  }
+
   const renderUserRow = (u: AdminUser) => (
     <div key={u.id} className='flex flex-col gap-2 px-3 py-2 text-small'>
       <div className='flex items-center gap-3'>
@@ -187,9 +201,20 @@ export function Admin() {
         <span className='w-[55px]'>
           {u.banned ? <Badge variant='red'>Banned</Badge> : <Badge variant='green'>Active</Badge>}
         </span>
-        <span className='flex w-[200px] justify-end gap-1'>
+        <span className='flex w-[300px] justify-end gap-1'>
           {u.id !== session?.user?.id && (
             <>
+              <Button
+                variant='active'
+                className='h-[28px] px-2 text-caption'
+                onClick={() => {
+                  sendPasswordReset.reset()
+                  sendPasswordReset.mutate({ userId: u.id, email: u.email })
+                }}
+                disabled={pendingUserIds.has(u.id)}
+              >
+                {resetPasswordLabel(u.id)}
+              </Button>
               <Button
                 variant='active'
                 className='h-[28px] px-2 text-caption'
@@ -401,11 +426,17 @@ export function Admin() {
             banUser.error ||
             unbanUser.error ||
             impersonateUser.error ||
+            sendPasswordReset.error ||
             impersonationGuardError) && (
             <p className='text-[var(--text-error)] text-small'>
               {impersonationGuardError ||
-                (setUserRole.error || banUser.error || unbanUser.error || impersonateUser.error)
-                  ?.message ||
+                (
+                  setUserRole.error ||
+                  banUser.error ||
+                  unbanUser.error ||
+                  impersonateUser.error ||
+                  sendPasswordReset.error
+                )?.message ||
                 'Action failed. Please try again.'}
             </p>
           )}

apps/sim/hooks/queries/admin-users.test.ts

@@ -3,8 +3,9 @@
  */
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCreateUser } = vi.hoisted(() => ({
+const { mockCreateUser, mockRequestJson } = vi.hoisted(() => ({
   mockCreateUser: vi.fn(),
+  mockRequestJson: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/auth-client', () => ({
@@ -15,11 +16,30 @@ vi.mock('@/lib/auth/auth-client', () => ({
   },
 }))
 
+vi.mock('@/lib/api/client/request', () => ({
+  requestJson: mockRequestJson,
+}))
+
+vi.mock('@/lib/core/utils/urls', () => ({
+  getBaseUrl: () => 'https://sim.test',
+}))
+
+import { forgetPasswordContract } from '@/lib/api/contracts'
 import { addUser } from '@/hooks/queries/admin-users'
 
+const CREATED_USER = {
+  id: 'user-1',
+  name: 'Canary Writer',
+  email: 'writer@synthetics.example.com',
+  role: 'user',
+  banned: false,
+  banReason: null,
+}
+
 describe('addUser', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockRequestJson.mockResolvedValue({ success: true })
   })
 
   it('creates a Better Auth credential user with normalized identity fields', async () => {
@@ -59,6 +79,62 @@ describe('addUser', () => {
       role: 'user',
       data: { emailVerified: true },
     })
+    expect(mockRequestJson).not.toHaveBeenCalled()
+  })
+
+  it('omits the password and emails a reset link when no password is given', async () => {
+    mockCreateUser.mockResolvedValue({ data: { user: CREATED_USER }, error: null })
+
+    await expect(
+      addUser({
+        name: 'Canary Writer',
+        email: '  Writer@Synthetics.Example.com ',
+        emailVerified: true,
+      })
+    ).resolves.toEqual(CREATED_USER)
+
+    expect(mockCreateUser).toHaveBeenCalledWith({
+      name: 'Canary Writer',
+      email: 'writer@synthetics.example.com',
+      role: 'user',
+      data: { emailVerified: true },
+    })
+    expect(mockCreateUser.mock.calls[0][0]).not.toHaveProperty('password')
+    expect(mockRequestJson).toHaveBeenCalledWith(forgetPasswordContract, {
+      body: {
+        email: 'writer@synthetics.example.com',
+        redirectTo: 'https://sim.test/reset-password',
+      },
+    })
+  })
+
+  it('never sends a reset email when the account was not created', async () => {
+    mockCreateUser.mockResolvedValue({
+      data: null,
+      error: { message: 'A user with that email already exists' },
+    })
+
+    await expect(
+      addUser({
+        name: 'Canary Writer',
+        email: 'writer@synthetics.example.com',
+        emailVerified: true,
+      })
+    ).rejects.toThrow('A user with that email already exists')
+    expect(mockRequestJson).not.toHaveBeenCalled()
+  })
+
+  it('names the row-level recovery path when the reset email fails to send', async () => {
+    mockCreateUser.mockResolvedValue({ data: { user: CREATED_USER }, error: null })
+    mockRequestJson.mockRejectedValue(new Error('SMTP unavailable'))
+
+    await expect(
+      addUser({
+        name: 'Canary Writer',
+        email: 'writer@synthetics.example.com',
+        emailVerified: true,
+      })
+    ).rejects.toThrow(/Account created, but the password reset email failed to send/)
   })
 
   it('surfaces resolved Better Auth errors', async () => {