florian.wilde
a9a9cf7ba4
Neue interne Route Handler unter app/api/ (dishes inkl. Bulk-Delete, sections, allergens, additives, menu-entries, dish-suggestions, settings, admin/branding) ersetzen den direkten Browser→Postgrest- Zugriff der bisherigen Supabase-Anbindung. Jede Route prüft Autorisierung selbst (lib/auth/session.ts requireRole) statt sich auf Postgres-RLS zu verlassen – ersetzt 1:1 die bisherigen Policies (öffentlich lesbar / staff+admin schreiben / nur admin für Einstellungen & Benutzer). Rezeptvorschlag-Dublettencheck (SuggestionForm) läuft jetzt zwingend serverseitig im POST-Handler, da es keinen Browser→Postgres-Pfad mehr gibt. "Passkey annehmen" (SuggestionReview) läuft transaktional (Gericht anlegen + Vorschlag löschen in einem Schritt). Logo/Favicon: neuer lokaler Dateispeicher (lib/branding.ts, Docker- Volume) statt Supabase-Storage-Bucket, ausgeliefert über app/branding/[filename]. logoUrl()/faviconUrl() liefern jetzt einfache relative Pfade statt einer fest verdrahteten Supabase-Storage-URL. DeepL-Route (api/translate) und Benutzerverwaltung (api/admin/users) laufen jetzt gegen die users-Tabelle statt Supabase Auth. Alle "use client"-Manager-Komponenten (DishManager, WeekEditor, SectionManager, CodeListManager, SuggestionForm/Review, UserManager, DesignEditor) rufen ihre jeweiligen /api/-Routen per fetch() statt den Supabase-Browser-Client zu nutzen.
77 lines
2.5 KiB
TypeScript
77 lines
2.5 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { queryOne, query } from "@/lib/db";
|
|
import { removeBrandingFile, saveBrandingFile } from "@/lib/branding";
|
|
import { authErrorResponse, requireRole } from "@/lib/auth/session";
|
|
import { isSameOrigin } from "@/lib/origin";
|
|
|
|
type AssetKind = "logo" | "favicon";
|
|
const ASSET_COLUMN: Record<AssetKind, "logo_path" | "favicon_path"> = {
|
|
logo: "logo_path",
|
|
favicon: "favicon_path",
|
|
};
|
|
|
|
function isAssetKind(value: unknown): value is AssetKind {
|
|
return value === "logo" || value === "favicon";
|
|
}
|
|
|
|
export async function POST(request: Request) {
|
|
if (!isSameOrigin(request)) {
|
|
return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
|
|
}
|
|
try {
|
|
await requireRole(["admin"]);
|
|
const form = await request.formData();
|
|
const kind = form.get("kind");
|
|
const file = form.get("file");
|
|
if (!isAssetKind(kind) || !(file instanceof File)) {
|
|
return NextResponse.json({ error: "invalid_input" }, { status: 400 });
|
|
}
|
|
if (!file.type.startsWith("image/")) {
|
|
return NextResponse.json({ error: "invalid_image" }, { status: 400 });
|
|
}
|
|
|
|
const old = await queryOne<{ path: string | null }>(
|
|
`select ${ASSET_COLUMN[kind]} as path from settings where id = 1`
|
|
);
|
|
|
|
const ext = file.name.split(".").pop()?.toLowerCase() ?? "png";
|
|
const filename = `${kind}-${Date.now()}.${ext}`;
|
|
const buffer = Buffer.from(await file.arrayBuffer());
|
|
await saveBrandingFile(filename, buffer);
|
|
|
|
await query(`update settings set ${ASSET_COLUMN[kind]} = $1 where id = 1`, [filename]);
|
|
if (old?.path) await removeBrandingFile(old.path);
|
|
|
|
return NextResponse.json({ path: filename });
|
|
} catch (err) {
|
|
const res = authErrorResponse(err);
|
|
if (res) return res;
|
|
throw err;
|
|
}
|
|
}
|
|
|
|
export async function DELETE(request: Request) {
|
|
if (!isSameOrigin(request)) {
|
|
return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
|
|
}
|
|
try {
|
|
await requireRole(["admin"]);
|
|
const { kind } = (await request.json()) as { kind?: unknown };
|
|
if (!isAssetKind(kind)) {
|
|
return NextResponse.json({ error: "invalid_input" }, { status: 400 });
|
|
}
|
|
|
|
const old = await queryOne<{ path: string | null }>(
|
|
`select ${ASSET_COLUMN[kind]} as path from settings where id = 1`
|
|
);
|
|
await query(`update settings set ${ASSET_COLUMN[kind]} = null where id = 1`);
|
|
if (old?.path) await removeBrandingFile(old.path);
|
|
|
|
return NextResponse.json({ ok: true });
|
|
} catch (err) {
|
|
const res = authErrorResponse(err);
|
|
if (res) return res;
|
|
throw err;
|
|
}
|
|
}
|