feat: implement internal auth user creation and update related functionalities

lib/auth/internal-users.ts

@@ -0,0 +1,65 @@
+import { createServiceRoleClient } from "@/lib/supabase/admin";
+
+type InternalAuthUserRole = "freelancer" | "client";
+
+type CreateInternalAuthUserInput = {
+  email: string;
+  password: string;
+  role: InternalAuthUserRole;
+  reason: string;
+};
+
+export async function createInternalAuthUser({
+  email,
+  password,
+  role,
+  reason,
+}: CreateInternalAuthUserInput) {
+  const admin = createServiceRoleClient();
+  const normalizedEmail = email.trim().toLowerCase();
+
+  if (!normalizedEmail || !password) {
+    throw new Error("E-posta ve şifre zorunludur.");
+  }
+
+  const { error: guardError } = await admin.rpc(
+    "request_internal_auth_creation",
+    {
+      target_email: normalizedEmail,
+      target_reason: reason,
+    },
+  );
+
+  if (guardError) {
+    throw new Error(
+      `Kullanıcı oluşturma hazırlığı tamamlanamadı: ${guardError.message}`,
+    );
+  }
+
+  const { data, error } = await admin.auth.admin.createUser({
+    email: normalizedEmail,
+    password,
+    email_confirm: true,
+    app_metadata: {
+      internal_created: true,
+      role,
+    },
+    user_metadata: {
+      role,
+    },
+  });
+
+  if (error) {
+    throw new Error(error.message);
+  }
+
+  if (!data.user?.id) {
+    throw new Error("Kullanıcı oluşturuldu fakat kullanıcı kimliği alınamadı.");
+  }
+
+  return {
+    admin,
+    user: data.user,
+    userId: data.user.id,
+  };
+}

lib/supabase/admin.ts

@@ -0,0 +1,18 @@
+import { createClient } from "@supabase/supabase-js";
+
+export function createServiceRoleClient() {
+  const supabaseUrl =
+    process.env.SUPABASE_INTERNAL_URL || process.env.NEXT_PUBLIC_SUPABASE_URL;
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+
+  if (!supabaseUrl || !serviceRoleKey) {
+    throw new Error("Supabase service role yapılandırması eksik.");
+  }
+
+  return createClient(supabaseUrl, serviceRoleKey, {
+    auth: {
+      autoRefreshToken: false,
+      persistSession: false,
+    },
+  });
+}