Bug: Self hosted invite codes should only be generated by admins

[hecht-a]

Hello 👋

Describe the bug
I found a security issue. All users can create invite codes.

To Reproduce
Steps to reproduce the behavior:

1. Login or Signup
2. Activate Require invite code for new sign ups
3. Generate a code
4. Create a new account with the code generated in the previous step
5. With this new account got to Settings > Self Hosted

Expected behavior
I think only "admin" users could generate codes.

What version of Maybe are you using?
Self Hosted, v0.2.0

What operating system and browser are you using?
The problem is on all OS and browsers

---

An idea to fix this problem would be to set an "admin email" in env vars. Only the user logged in with this email could do some actions like generate invite code.
If this solution sounds good to you, I can implement it.

[zachgoll]

@hecht-a yep, think that would be a good improvement. This should be relatively simple—we've already got a role field on the users table, so just a matter of checking Current.user.admin? prior to the code generation in InviteCodesController