Arnaud
c5e1643d39
- Notification email preferences: every push category (follow, comment, reply, reaction, rating, mention, leftoverExpiring, shoppingList) now has an independent email toggle, plus a Weekly Digest toggle. Previously email sent unconditionally whenever the recipient had one; now gated the same way push already was. The weekly-digest cron route excludes opted-out users. - Admin-only site-wide webhooks (Admin → Webhooks): new signups, support tickets, and reports filed can now fire an HMAC-signed HTTP webhook (Slack/Discord/ops alerting), independent of the existing per-user webhooks (which stay scoped to a user's own recipe/meal-plan/shopping-list events). Signing/delivery logic factored into lib/webhook-delivery.ts and shared by both dispatchers instead of duplicated. - Settings → Features: users can hide Nutrition, Pantry, Meal Plan, Shopping Lists, Collections, or Messages from their own nav. Purely cosmetic — hidden pages stay reachable by direct link, nothing is access-restricted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
74 lines
2.7 KiB
TypeScript
74 lines
2.7 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { z } from "zod";
|
|
import { db, adminWebhooks, eq } from "@epicure/db";
|
|
import { requireAdmin } from "@/lib/api-auth";
|
|
import { validateWebhookUrl } from "@/lib/validate-webhook-url";
|
|
import { ADMIN_WEBHOOK_EVENTS } from "@/lib/admin-webhooks";
|
|
|
|
const UpdateWebhookBody = z.object({
|
|
url: z.string().min(1).max(2048).optional(),
|
|
events: z.array(z.enum(ADMIN_WEBHOOK_EVENTS)).optional(),
|
|
active: z.boolean().optional(),
|
|
});
|
|
|
|
type Params = { params: Promise<{ id: string }> };
|
|
|
|
export async function DELETE(_req: NextRequest, { params }: Params) {
|
|
const { response } = await requireAdmin();
|
|
if (response) return response;
|
|
|
|
const { id } = await params;
|
|
|
|
const existing = await db.select({ id: adminWebhooks.id }).from(adminWebhooks).where(eq(adminWebhooks.id, id)).limit(1);
|
|
if (existing.length === 0) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
await db.delete(adminWebhooks).where(eq(adminWebhooks.id, id));
|
|
return new NextResponse(null, { status: 204 });
|
|
}
|
|
|
|
export async function PATCH(req: NextRequest, { params }: Params) {
|
|
const { response } = await requireAdmin();
|
|
if (response) return response;
|
|
|
|
const { id } = await params;
|
|
|
|
const existing = await db.select({ id: adminWebhooks.id }).from(adminWebhooks).where(eq(adminWebhooks.id, id)).limit(1);
|
|
if (existing.length === 0) return NextResponse.json({ error: "Not found" }, { status: 404 });
|
|
|
|
const body = await req.json() as unknown;
|
|
const parsed = UpdateWebhookBody.safeParse(body);
|
|
if (!parsed.success) {
|
|
return NextResponse.json({ error: "Validation error", issues: parsed.error.issues }, { status: 400 });
|
|
}
|
|
|
|
if (parsed.data.url) {
|
|
const ssrfError = await validateWebhookUrl(parsed.data.url);
|
|
if (ssrfError) return NextResponse.json({ error: ssrfError }, { status: 400 });
|
|
}
|
|
|
|
const updates: Partial<{ url: string; events: string[]; active: boolean }> = {};
|
|
if (parsed.data.url !== undefined) updates.url = parsed.data.url;
|
|
if (parsed.data.events !== undefined) updates.events = parsed.data.events;
|
|
if (parsed.data.active !== undefined) updates.active = parsed.data.active;
|
|
|
|
if (Object.keys(updates).length === 0) {
|
|
return NextResponse.json({ error: "No fields to update" }, { status: 400 });
|
|
}
|
|
|
|
await db.update(adminWebhooks).set(updates).where(eq(adminWebhooks.id, id));
|
|
|
|
const updated = await db
|
|
.select({
|
|
id: adminWebhooks.id,
|
|
url: adminWebhooks.url,
|
|
events: adminWebhooks.events,
|
|
active: adminWebhooks.active,
|
|
createdAt: adminWebhooks.createdAt,
|
|
})
|
|
.from(adminWebhooks)
|
|
.where(eq(adminWebhooks.id, id))
|
|
.limit(1);
|
|
|
|
return NextResponse.json(updated[0]);
|
|
}
|