feat(web): Next.js 15 app shell, auth, i18n, base UI

App Router setup with next-intl (en/fr), Better Auth wiring, shadcn/ui components, Tailwind, AES-256-GCM encrypt util, Redis rate limiter, tier limit checker, site_settings helper for runtime .env overrides.
2026-07-01 08:09:31 +02:00
parent add9365250
commit 5b40968c9d
50 changed files with 4274 additions and 0 deletions
@@ -0,0 +1,90 @@
+import { db, siteSettings, eq } from "@epicure/db";
+import { encrypt, decrypt } from "@/lib/encrypt";
+
+export type SiteSettingKey =
+  | "OPENAI_API_KEY"
+  | "ANTHROPIC_API_KEY"
+  | "OPENROUTER_API_KEY"
+  | "OPENROUTER_DEFAULT_MODEL"
+  | "OLLAMA_BASE_URL"
+  | "NEXT_PUBLIC_VAPID_PUBLIC_KEY"
+  | "VAPID_PRIVATE_KEY";
+
+const SECRET_KEYS: SiteSettingKey[] = [
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "OPENROUTER_API_KEY",
+  "VAPID_PRIVATE_KEY",
+];
+
+export function isSecretKey(key: SiteSettingKey): boolean {
+  return SECRET_KEYS.includes(key);
+}
+
+export async function getSiteSetting(key: SiteSettingKey): Promise<string | null> {
+  try {
+    const row = await db.query.siteSettings.findFirst({ where: eq(siteSettings.key, key) });
+    if (row?.value) {
+      return row.isSecret ? decrypt(row.value) : row.value;
+    }
+  } catch {
+    // fall through to env
+  }
+  return process.env[key] ?? null;
+}
+
+export async function getAllSiteSettings(): Promise<Record<string, { value: string | null; isSecret: boolean; fromDb: boolean }>> {
+  const rows = await db.query.siteSettings.findMany();
+  const dbMap = new Map(rows.map((r) => [r.key, r]));
+
+  const KNOWN_KEYS: SiteSettingKey[] = [
+    "OPENAI_API_KEY",
+    "ANTHROPIC_API_KEY",
+    "OPENROUTER_API_KEY",
+    "OPENROUTER_DEFAULT_MODEL",
+    "OLLAMA_BASE_URL",
+    "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
+    "VAPID_PRIVATE_KEY",
+  ];
+
+  const result: Record<string, { value: string | null; isSecret: boolean; fromDb: boolean }> = {};
+  for (const k of KNOWN_KEYS) {
+    const row = dbMap.get(k);
+    const secret = isSecretKey(k);
+    if (row) {
+      result[k] = {
+        value: secret ? "••••••••••••" : (row.value ?? null),
+        isSecret: secret,
+        fromDb: true,
+      };
+    } else {
+      const envVal = process.env[k];
+      result[k] = {
+        value: envVal ? (secret ? "••••••••••••" : envVal) : null,
+        isSecret: secret,
+        fromDb: false,
+      };
+    }
+  }
+  return result;
+}
+
+export async function setSiteSetting(
+  key: SiteSettingKey,
+  value: string | null,
+  updatedById: string
+): Promise<void> {
+  if (value === null || value === "") {
+    await db.delete(siteSettings).where(eq(siteSettings.key, key));
+    return;
+  }
+  const secret = isSecretKey(key);
+  const stored = secret ? encrypt(value) : value;
+  await db
+    .insert(siteSettings)
+    .values({ key, value: stored, isSecret: secret, updatedById, updatedAt: new Date() })
+    .onConflictDoUpdate({
+      target: siteSettings.key,
+      set: { value: stored, updatedAt: new Date(), updatedById },
+    });
+}