fix(admin): surface a created user when only its reset email failed

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.test.tsx

@@ -115,7 +115,7 @@ vi.mock('@/hooks/queries/admin-users', () => ({
 }))
 
 import { AddUserModal } from '@/app/workspace/[workspaceId]/settings/components/admin/add-user-modal'
-import type { AddUserInput, AdminUser } from '@/hooks/queries/admin-users'
+import type { AddUserInput, AddUserResult, AdminUser } from '@/hooks/queries/admin-users'
 
 const CREATED_USER: AdminUser = {
   id: 'user-1',
@@ -128,7 +128,7 @@ const CREATED_USER: AdminUser = {
 
 let container: HTMLDivElement
 let root: Root
-let onCreated: ReturnType<typeof vi.fn<(user: AdminUser) => void>>
+let onCreated: ReturnType<typeof vi.fn<(user: AdminUser, resetEmailError?: string) => void>>
 let onOpenChange: ReturnType<typeof vi.fn<(open: boolean) => void>>
 
 async function renderModal() {
@@ -203,8 +203,8 @@ describe('AddUserModal', () => {
 
   it('creates a verified credential user and returns it to the admin view', async () => {
     mockMutate.mockImplementation(
-      (_input: AddUserInput, options: { onSuccess: (user: AdminUser) => void }) => {
-        options.onSuccess(CREATED_USER)
+      (_input: AddUserInput, options: { onSuccess: (result: AddUserResult) => void }) => {
+        options.onSuccess({ user: CREATED_USER })
       }
     )
     await renderModal()
@@ -226,7 +226,7 @@ describe('AddUserModal', () => {
       { onSuccess: expect.any(Function), onSettled: expect.any(Function) }
     )
     expect(onOpenChange).toHaveBeenCalledWith(false)
-    expect(onCreated).toHaveBeenCalledWith(CREATED_USER)
+    expect(onCreated).toHaveBeenCalledWith(CREATED_USER, undefined)
   })
 
   it('ignores repeated submissions before the pending state renders', async () => {
@@ -246,8 +246,8 @@ describe('AddUserModal', () => {
 
   it('supports unverified accounts without exposing a platform-role control', async () => {
     mockMutate.mockImplementation(
-      (_input: AddUserInput, options: { onSuccess: (user: AdminUser) => void }) => {
-        options.onSuccess(CREATED_USER)
+      (_input: AddUserInput, options: { onSuccess: (result: AddUserResult) => void }) => {
+        options.onSuccess({ user: CREATED_USER })
       }
     )
     await renderModal()
@@ -269,8 +269,8 @@ describe('AddUserModal', () => {
 
   it('drops the password field and submits without one when emailing a reset link', async () => {
     mockMutate.mockImplementation(
-      (_input: AddUserInput, options: { onSuccess: (user: AdminUser) => void }) => {
-        options.onSuccess(CREATED_USER)
+      (_input: AddUserInput, options: { onSuccess: (result: AddUserResult) => void }) => {
+        options.onSuccess({ user: CREATED_USER })
       }
     )
     await renderModal()
@@ -295,7 +295,7 @@ describe('AddUserModal', () => {
       },
       { onSuccess: expect.any(Function), onSettled: expect.any(Function) }
     )
-    expect(onCreated).toHaveBeenCalledWith(CREATED_USER)
+    expect(onCreated).toHaveBeenCalledWith(CREATED_USER, undefined)
   })
 
   it('keeps a typed password across a round trip through the reset-link flow', async () => {
@@ -308,6 +308,30 @@ describe('AddUserModal', () => {
     expect(buttonLabelled('Add user').disabled).toBe(false)
   })
 
+  it('still hands the user back when only its reset email failed', async () => {
+    mockMutate.mockImplementation(
+      (_input: AddUserInput, options: { onSuccess: (result: AddUserResult) => void }) => {
+        options.onSuccess({ user: CREATED_USER, resetEmailError: 'SMTP unavailable' })
+      }
+    )
+    await renderModal()
+    await changeField('Name', 'Canary Writer')
+    await changeField('Email', 'writer@synthetics.example.com')
+    await changeField('Credentials', 'email')
+
+    await act(async () => {
+      buttonLabelled('Add user').dispatchEvent(new MouseEvent('click', { bubbles: true }))
+      await Promise.resolve()
+      await Promise.resolve()
+    })
+
+    // The account exists, so this closes like any other create — the host
+    // surfaces the user (and the reason) rather than stranding the operator in
+    // a modal whose form no longer maps to anything.
+    expect(onOpenChange).toHaveBeenCalledWith(false)
+    expect(onCreated).toHaveBeenCalledWith(CREATED_USER, 'SMTP unavailable')
+  })
+
   it('shows Better Auth failures without closing the modal', async () => {
     addUserMutation.current = {
       isPending: false,

apps/sim/app/workspace/[workspaceId]/settings/components/admin/add-user-modal.tsx

@@ -28,7 +28,13 @@ type PasswordMode = (typeof PASSWORD_MODE_OPTIONS)[number]['value']
 interface AddUserModalProps {
   open: boolean
   onOpenChange: (open: boolean) => void
-  onCreated: (user: AdminUser) => void
+  /**
+   * The account was created. `resetEmailError` is set when its provisioning
+   * reset email could not be sent — the account still exists, so the host is
+   * expected to surface the user (and report this) rather than treat it as a
+   * failed create.
+   */
+  onCreated: (user: AdminUser, resetEmailError?: string) => void
 }
 
 export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProps) {
@@ -86,10 +92,10 @@ export function AddUserModal({ open, onOpenChange, onCreated }: AddUserModalProp
         ...(setsPassword ? { password } : {}),
       },
       {
-        onSuccess: (user) => {
+        onSuccess: ({ user, resetEmailError }) => {
           reset()
           onOpenChange(false)
-          onCreated(user)
+          onCreated(user, resetEmailError)
         },
         onSettled: () => {
           submissionInFlightRef.current = false

apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx

@@ -77,6 +77,7 @@ export function Admin() {
   const [impersonatingUserId, setImpersonatingUserId] = useState<string | null>(null)
   const [impersonationGuardError, setImpersonationGuardError] = useState<string | null>(null)
   const [isAddUserOpen, setIsAddUserOpen] = useState(false)
+  const [provisionWarning, setProvisionWarning] = useState<string | null>(null)
 
   const {
     data: usersData,
@@ -208,6 +209,7 @@ export function Admin() {
                 variant='active'
                 className='h-[28px] px-2 text-caption'
                 onClick={() => {
+                  setProvisionWarning(null)
                   sendPasswordReset.reset()
                   sendPasswordReset.mutate({ userId: u.id, email: u.email })
                 }}
@@ -441,6 +443,10 @@ export function Admin() {
             </p>
           )}
 
+          {provisionWarning && (
+            <p className='text-[var(--text-error)] text-small'>{provisionWarning}</p>
+          )}
+
           {searchQuery.length > 0 && usersData ? (
             <>
               <div className='flex flex-col gap-0.5'>
@@ -500,9 +506,16 @@ export function Admin() {
       <AddUserModal
         open={isAddUserOpen}
         onOpenChange={setIsAddUserOpen}
-        onCreated={(user) => {
+        onCreated={(user, resetEmailError) => {
+          // Search for the new user either way: when the reset email failed,
+          // the recovery action named below lives on that user's row.
           setSearchInput(user.email)
           setAdminParams({ q: user.email, offset: null })
+          setProvisionWarning(
+            resetEmailError
+              ? `Created ${user.email}, but the password reset email failed to send (${resetEmailError}). Use Reset password on their row to try again.`
+              : null
+          )
         }}
       />
     </SettingsPanel>

apps/sim/hooks/queries/admin-users.test.ts

@@ -64,14 +64,7 @@ describe('addUser', () => {
         password: 'canary-password',
         emailVerified: true,
       })
-    ).resolves.toEqual({
-      id: 'user-1',
-      name: 'Canary Writer',
-      email: 'writer@synthetics.example.com',
-      role: 'user',
-      banned: false,
-      banReason: null,
-    })
+    ).resolves.toEqual({ user: CREATED_USER })
     expect(mockCreateUser).toHaveBeenCalledWith({
       name: 'Canary Writer',
       email: 'writer@synthetics.example.com',
@@ -91,7 +84,7 @@ describe('addUser', () => {
         email: '  Writer@Synthetics.Example.com ',
         emailVerified: true,
       })
-    ).resolves.toEqual(CREATED_USER)
+    ).resolves.toEqual({ user: CREATED_USER })
 
     expect(mockCreateUser).toHaveBeenCalledWith({
       name: 'Canary Writer',
@@ -124,17 +117,19 @@ describe('addUser', () => {
     expect(mockRequestJson).not.toHaveBeenCalled()
   })
 
-  it('names the row-level recovery path when the reset email fails to send', async () => {
+  it('still returns the created user when only the reset email fails', async () => {
     mockCreateUser.mockResolvedValue({ data: { user: CREATED_USER }, error: null })
     mockRequestJson.mockRejectedValue(new Error('SMTP unavailable'))
 
+    // The account exists, so this must not surface as a failed create — the
+    // caller needs the user to reach its row's own "Reset password" action.
     await expect(
       addUser({
         name: 'Canary Writer',
         email: 'writer@synthetics.example.com',
         emailVerified: true,
       })
-    ).rejects.toThrow(/Account created, but the password reset email failed to send/)
+    ).resolves.toEqual({ user: CREATED_USER, resetEmailError: 'SMTP unavailable' })
   })
 
   it('surfaces resolved Better Auth errors', async () => {

apps/sim/hooks/queries/admin-users.ts

@@ -63,12 +63,24 @@ function mapUser(u: {
   }
 }
 
+export interface AddUserResult {
+  user: AdminUser
+  /**
+   * Why the provisioning reset email could not be sent, when the account itself
+   * was created. Deliberately not a thrown error: the account exists, so
+   * re-submitting the form would only collide on the email. Callers finish the
+   * create — surfacing the user so its row, and that row's "Reset password"
+   * action, are reachable — and report this alongside.
+   */
+  resetEmailError?: string
+}
+
 export async function addUser({
   name,
   email,
   password,
   emailVerified,
-}: AddUserInput): Promise<AdminUser> {
+}: AddUserInput): Promise<AddUserResult> {
   const normalizedEmail = email.trim().toLowerCase()
   const { data, error } = await client.admin.createUser({
     name: name.trim(),
@@ -80,26 +92,15 @@ export async function addUser({
   if (error) throw new Error(error.message ?? 'Failed to add user')
   if (!data?.user) throw new Error('Better Auth did not return the created user')
 
-  if (!password) {
-    try {
-      await sendPasswordResetEmail(normalizedEmail)
-    } catch (resetError) {
-      /**
-       * The account exists at this point, so re-submitting the form would only
-       * collide on the email. Name the recovery path instead — the caller
-       * surfaces this verbatim, and the new user is already in the list behind
-       * the modal with its own "Reset password" action.
-       */
-      throw new Error(
-        `Account created, but the password reset email failed to send (${getErrorMessage(
-          resetError,
-          'unknown error'
-        )}). Use "Reset password" on the user's row to try again.`
-      )
-    }
-  }
+  const user = mapUser(data.user)
+  if (password) return { user }
 
-  return mapUser(data.user)
+  try {
+    await sendPasswordResetEmail(normalizedEmail)
+    return { user }
+  } catch (resetError) {
+    return { user, resetEmailError: getErrorMessage(resetError, 'unknown error') }
+  }
 }
 
 /** Sends the standard password reset email, the same one the login page requests. */