Arnaud
4c3880e07f
Moderator role existed in the schema and was already respected by
comment deletion, but every admin page/route treated moderator
identically to a regular user (403/redirect). Wires it up narrowly:
admin/layout.tsx now lets admin+moderator through and filters the
nav by role, while every admin-only page (users, tiers, settings,
webhooks, insights, etc.) explicitly redirects moderators away via a
new requireFullAdminPage() helper -- the nav filter is UX, this is
the actual gate. Moderators land on Reports and Recipes: reports
GET/PATCH now accept requireAdmin({allowModerator: true}), and a new
PATCH /api/v1/admin/recipes/[id] lets admin+moderator unpublish a
public recipe (flip to private) as a takedown action, audit-logged.
Also found and fixed a real bug while auditing the PWA push pipeline
for a "push click-through" gap: public/sw.js had no `push` event
listener at all, so incoming push messages never displayed anything
-- push was silently non-functional end-to-end despite the
subscribe/send plumbing all working. Added the push listener
(showNotification) and a notificationclick listener that focuses an
existing tab or opens one at the payload's url.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
52 lines
2.1 KiB
TypeScript
52 lines
2.1 KiB
TypeScript
import type { Metadata } from "next";
|
|
import { getAllSiteSettings, isSignupsDisabled } from "@/lib/site-settings";
|
|
import { AdminSettingsForm } from "@/components/admin/admin-settings-form";
|
|
import { SignupsToggle } from "@/components/admin/signups-toggle";
|
|
import { requireFullAdminPage } from "@/lib/require-admin-page";
|
|
|
|
export const metadata: Metadata = {};
|
|
|
|
const SETTING_GROUPS = [
|
|
{
|
|
title: "Push Notifications (VAPID)",
|
|
description: "Keys for web push notifications. Generate with: npx web-push generate-vapid-keys",
|
|
keys: ["NEXT_PUBLIC_VAPID_PUBLIC_KEY", "VAPID_PRIVATE_KEY"] as const,
|
|
},
|
|
{
|
|
title: "Gitea Integration",
|
|
description:
|
|
"Support tickets submitted in-app automatically open an issue on this Gitea repo. Setup: " +
|
|
"GITEA_URL = your Gitea base URL, no trailing slash (e.g. https://git.example.com). " +
|
|
"GITEA_REPO = owner/repo (e.g. owner/my-app). " +
|
|
"GITEA_TOKEN = a personal access token — Gitea → Settings → Applications → Generate New Token — " +
|
|
"with the \"issue\" scope (read + write) only; nothing broader is needed since this integration " +
|
|
"never touches code or repo settings, just creates issues.",
|
|
keys: ["GITEA_URL", "GITEA_TOKEN", "GITEA_REPO"] as const,
|
|
},
|
|
];
|
|
|
|
export default async function AdminSettingsPage() {
|
|
await requireFullAdminPage();
|
|
const settings = await getAllSiteSettings();
|
|
const signupsDisabled = await isSignupsDisabled();
|
|
|
|
return (
|
|
<div className="space-y-8">
|
|
<div>
|
|
<h1 className="text-2xl font-bold tracking-tight">Site Settings</h1>
|
|
<p className="text-muted-foreground text-sm mt-1">
|
|
Override .env values at runtime. DB values take precedence over environment variables.
|
|
Clear a value to fall back to the environment variable. AI provider keys and model
|
|
defaults have moved to AI Config.
|
|
</p>
|
|
</div>
|
|
|
|
<SignupsToggle initialDisabled={signupsDisabled} />
|
|
|
|
{SETTING_GROUPS.map((group) => (
|
|
<AdminSettingsForm key={group.title} group={group} settings={settings} />
|
|
))}
|
|
</div>
|
|
);
|
|
}
|