Speisekarte/app/api/settings/route.ts

import { NextResponse } from "next/server";
import { query } from "@/lib/db";
import { getSettings, type LabelingMode } from "@/lib/db/settings";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

export async function GET() {
  return NextResponse.json(await getSettings());
}

interface SettingsPatchBody {
  colors?: Record<string, string>;
  labeling_mode?: LabelingMode;
  labeling_notice?: string;
  labeling_notice_en?: string | null;
  labeling_notice_pl?: string | null;
}

export async function PATCH(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    // Farben bleiben admin-only wie bisher; die Allergen-/Zusatzstoff-
    // Anzeige darf auch Kantinenpersonal umschalten/bearbeiten.
    const session = await requireRole(["staff", "admin"]);
    const body = (await request.json()) as SettingsPatchBody;

    const sets: string[] = [];
    const params: unknown[] = [];

    if (body.colors !== undefined) {
      if (session.user.role !== "admin") {
        return NextResponse.json({ error: "forbidden" }, { status: 403 });
      }
      params.push(JSON.stringify(body.colors));
      sets.push(`colors = $${params.length}`);
    }
    if (body.labeling_mode !== undefined) {
      if (body.labeling_mode !== "detailed" && body.labeling_mode !== "notice") {
        return NextResponse.json({ error: "invalid_input" }, { status: 400 });
      }
      params.push(body.labeling_mode);
      sets.push(`labeling_mode = $${params.length}`);
    }
    if (body.labeling_notice !== undefined) {
      params.push(body.labeling_notice);
      sets.push(`labeling_notice = $${params.length}`);
    }
    if (body.labeling_notice_en !== undefined) {
      params.push(body.labeling_notice_en);
      sets.push(`labeling_notice_en = $${params.length}`);
    }
    if (body.labeling_notice_pl !== undefined) {
      params.push(body.labeling_notice_pl);
      sets.push(`labeling_notice_pl = $${params.length}`);
    }

    if (sets.length === 0) {
      return NextResponse.json({ error: "invalid_input" }, { status: 400 });
    }
    await query(`update settings set ${sets.join(", ")} where id = 1`, params);
    return NextResponse.json({ ok: true });
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    throw err;
  }
}