Epicure/apps/web/lib/site-settings.ts

import { db, siteSettings, eq } from "@epicure/db";
import { encrypt, decrypt } from "@/lib/encrypt";

export type SiteSettingKey =
  | "OPENAI_API_KEY"
  | "ANTHROPIC_API_KEY"
  | "OPENROUTER_API_KEY"
  | "OPENROUTER_DEFAULT_MODEL"
  | "OLLAMA_BASE_URL"
  | "NEXT_PUBLIC_VAPID_PUBLIC_KEY"
  | "VAPID_PRIVATE_KEY";

const SECRET_KEYS: SiteSettingKey[] = [
  "OPENAI_API_KEY",
  "ANTHROPIC_API_KEY",
  "OPENROUTER_API_KEY",
  "VAPID_PRIVATE_KEY",
];

export function isSecretKey(key: SiteSettingKey): boolean {
  return SECRET_KEYS.includes(key);
}

export async function getSiteSetting(key: SiteSettingKey): Promise<string | null> {
  try {
    const row = await db.query.siteSettings.findFirst({ where: eq(siteSettings.key, key) });
    if (row?.value) {
      return row.isSecret ? decrypt(row.value) : row.value;
    }
  } catch {
    // fall through to env
  }
  return process.env[key] ?? null;
}

export async function getAllSiteSettings(): Promise<Record<string, { value: string | null; isSecret: boolean; fromDb: boolean }>> {
  const rows = await db.query.siteSettings.findMany();
  const dbMap = new Map(rows.map((r) => [r.key, r]));

  const KNOWN_KEYS: SiteSettingKey[] = [
    "OPENAI_API_KEY",
    "ANTHROPIC_API_KEY",
    "OPENROUTER_API_KEY",
    "OPENROUTER_DEFAULT_MODEL",
    "OLLAMA_BASE_URL",
    "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
    "VAPID_PRIVATE_KEY",
  ];

  const result: Record<string, { value: string | null; isSecret: boolean; fromDb: boolean }> = {};
  for (const k of KNOWN_KEYS) {
    const row = dbMap.get(k);
    const secret = isSecretKey(k);
    if (row) {
      result[k] = {
        value: secret ? "••••••••••••" : (row.value ?? null),
        isSecret: secret,
        fromDb: true,
      };
    } else {
      const envVal = process.env[k];
      result[k] = {
        value: envVal ? (secret ? "••••••••••••" : envVal) : null,
        isSecret: secret,
        fromDb: false,
      };
    }
  }
  return result;
}

export async function setSiteSetting(
  key: SiteSettingKey,
  value: string | null,
  updatedById: string
): Promise<void> {
  if (value === null || value === "") {
    await db.delete(siteSettings).where(eq(siteSettings.key, key));
    return;
  }
  const secret = isSecretKey(key);
  const stored = secret ? encrypt(value) : value;
  await db
    .insert(siteSettings)
    .values({ key, value: stored, isSecret: secret, updatedById, updatedAt: new Date() })
    .onConflictDoUpdate({
      target: siteSettings.key,
      set: { value: stored, updatedAt: new Date(), updatedById },
    });
}