feat(admin): admin panel with overview, users, audit logs, storage, AI config, settings

Sticky sidebar with back-to-app link. Overview: user counts, recipe photos, AI calls/month. User management with role/tier editing. Audit log (all admin actions). Storage page with photo breakdown by tier. AI config showing DB vs .env key source. Site settings page to override .env values at runtime (encrypted in DB).
2026-07-01 08:10:59 +02:00
parent b2d592afe8
commit cba5d9c3ac
14 changed files with 1197 additions and 0 deletions
@@ -0,0 +1,51 @@
+import { type NextRequest, NextResponse } from "next/server";
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth/server";
+import { db, users, auditLogs, eq } from "@epicure/db";
+import { setSiteSetting, type SiteSettingKey } from "@/lib/site-settings";
+import { randomUUID } from "crypto";
+
+const ALLOWED_KEYS: SiteSettingKey[] = [
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  "OPENROUTER_API_KEY",
+  "OPENROUTER_DEFAULT_MODEL",
+  "OLLAMA_BASE_URL",
+  "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
+  "VAPID_PRIVATE_KEY",
+];
+
+async function requireAdmin() {
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return null;
+  const [dbUser] = await db.select({ role: users.role }).from(users).where(eq(users.id, session.user.id));
+  if (dbUser?.role !== "admin") return null;
+  return session;
+}
+
+export async function PUT(req: NextRequest) {
+  const session = await requireAdmin();
+  if (!session) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+
+  const body = (await req.json()) as Record<string, string | null>;
+
+  const changed: string[] = [];
+  for (const [key, value] of Object.entries(body)) {
+    if (!ALLOWED_KEYS.includes(key as SiteSettingKey)) continue;
+    await setSiteSetting(key as SiteSettingKey, value, session.user.id);
+    changed.push(key);
+  }
+
+  if (changed.length > 0) {
+    await db.insert(auditLogs).values({
+      id: randomUUID(),
+      userId: session.user.id,
+      action: "admin.settings.update",
+      targetType: "site_settings",
+      metadata: JSON.stringify({ keys: changed }),
+      createdAt: new Date(),
+    });
+  }
+
+  return NextResponse.json({ ok: true });
+}