From 6177c0cde1d9c346c497478774a6e4c4ccf1db7d Mon Sep 17 00:00:00 2001
From: DanielS <daniel.schumacher@caspos.de>
Date: Tue, 11 Aug 2026 00:20:07 +0200
Subject: [PATCH] feat: send security lockout emails to all admin users

---
 shop/lib/actions/auth.ts | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/shop/lib/actions/auth.ts b/shop/lib/actions/auth.ts
index 4f9170e..d8436d3 100644
--- a/shop/lib/actions/auth.ts
+++ b/shop/lib/actions/auth.ts
@@ -35,8 +35,23 @@ export async function signIn(email: string, password: string) {
           .from('users')
           .update({ role: 'gesperrt' })
           .eq('email', email)
-        // Notify admin
-        await sendLockoutEmail('info@hephex.de')
+        // Notify all admins
+        try {
+          const adminClient = createAdminClient()
+          const { data: admins } = await adminClient
+            .from('users')
+            .select('email')
+            .eq('role', 'admin')
+          
+          if (admins && admins.length > 0) {
+            const adminEmails = admins.map(a => a.email).filter(Boolean)
+            for (const adminEmail of adminEmails) {
+              await sendLockoutEmail(adminEmail)
+            }
+          }
+        } catch (mailError) {
+          console.error('Failed to notify admins of lockout:', mailError)
+        }
         return { success: false, error: 'Konto gesperrt nach 5 Fehlversuchen.' }
       }