69 lines
2.4 KiB
TypeScript
69 lines
2.4 KiB
TypeScript
export const dynamic = 'force-dynamic'
|
|
|
|
import { NextRequest, NextResponse } from 'next/server'
|
|
import { getSession } from '@/lib/auth/get-session'
|
|
import { sql } from 'drizzle-orm'
|
|
import { asAdmin } from '@/lib/db/with-user'
|
|
import { writeAuditLog } from '@/lib/db/audit'
|
|
import { appSettings } from '@/lib/db/schema'
|
|
|
|
const ALLOWED_KEYS = [
|
|
'DEEPSEEK_API_KEY',
|
|
'GOOGLE_AI_API_KEY',
|
|
'META_WHATSAPP_PHONE_NUMBER_ID',
|
|
'META_WHATSAPP_ACCESS_TOKEN',
|
|
] as const
|
|
type SettingKey = typeof ALLOWED_KEYS[number]
|
|
|
|
export async function GET() {
|
|
const session = await getSession()
|
|
if (!session || session.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
const data = await asAdmin(db =>
|
|
db.select({ key: appSettings.key, value: appSettings.value, updatedAt: appSettings.updatedAt })
|
|
.from(appSettings)
|
|
)
|
|
const masked = data.map(row => ({
|
|
key: row.key,
|
|
set: Boolean(row.value),
|
|
masked_value: row.value ? `${row.value.slice(0, 8)}${'•'.repeat(12)}` : '',
|
|
updated_at: row.updatedAt,
|
|
}))
|
|
return NextResponse.json(masked)
|
|
}
|
|
|
|
export async function POST(request: NextRequest) {
|
|
const session = await getSession()
|
|
if (!session || session.role !== 'admin') return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
|
|
|
|
let body: { key?: string; value?: string }
|
|
try { body = await request.json() } catch {
|
|
return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
|
|
}
|
|
|
|
if (!body.key || !ALLOWED_KEYS.includes(body.key as SettingKey)) {
|
|
return NextResponse.json({ error: 'Invalid key' }, { status: 422 })
|
|
}
|
|
if (typeof body.value !== 'string' || body.value.trim() === '') {
|
|
return NextResponse.json({ error: 'value must be a non-empty string' }, { status: 422 })
|
|
}
|
|
|
|
await asAdmin(async db => {
|
|
await db.transaction(async tx => {
|
|
await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
|
|
await tx.insert(appSettings).values({
|
|
key: body.key!,
|
|
value: body.value!,
|
|
updatedAt: new Date(),
|
|
updatedBy: session.sub,
|
|
}).onConflictDoUpdate({
|
|
target: appSettings.key,
|
|
set: { value: body.value!, updatedAt: new Date(), updatedBy: session.sub },
|
|
})
|
|
await writeAuditLog(tx, 'app_settings', session.sub, 'UPDATE', { key: body.key, set: Boolean(body.value) })
|
|
})
|
|
})
|
|
|
|
return NextResponse.json({ ok: true })
|
|
}
|