9f912aed24
Added comprehensive authentication and authorization system: Authentication System: - Better Auth integration with session management - Login/logout pages and API routes - Middleware for route protection - Auth utilities and client libraries User Management: - User list, detail, and invite pages - User API endpoints (CRUD operations) - Session management for users - Profile settings page Role-Based Access Control: - Role management pages (list, create, edit) - Permission system with granular controls - Role assignment to users - Role API endpoints Admin Features: - Audit log page for tracking system events - Admin settings page - Audit service for logging user actions Additional Features: - Quotes management pages and components - SalesBldr API integration - Email service for notifications Configuration & Documentation: - Updated docker-compose.yml - MCP server configuration (mcp.json) - CVE-2025-55182 security review documentation - Standards guide and PRD documents - Re-enabling authentication documentation Database Migrations: - 012: Auth tables (users, sessions, accounts, verifications) - 013: Role tables (roles, permissions, role_permissions, user_roles) - 014: Admin settings table UI Updates: - Updated dashboard layout - Enhanced app layout with auth integration
88 lines
2.4 KiB
TypeScript
88 lines
2.4 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { Pool } from "pg";
|
|
import { requireAdmin, requireSuperAdmin, getSession } from "@/lib/auth-utils";
|
|
import { audit } from "@/lib/services/audit";
|
|
|
|
const pool = new Pool({
|
|
connectionString: process.env.DATABASE_URL,
|
|
});
|
|
|
|
// GET /api/admin/settings - Get all app settings
|
|
export async function GET(request: NextRequest) {
|
|
const { error } = await requireAdmin();
|
|
if (error) return error;
|
|
|
|
try {
|
|
const result = await pool.query(
|
|
`SELECT key, value, description FROM "app_settings" ORDER BY key`
|
|
);
|
|
|
|
// Convert to key-value object
|
|
const settings: Record<string, string> = {};
|
|
result.rows.forEach((row) => {
|
|
settings[row.key] = row.value;
|
|
});
|
|
|
|
return NextResponse.json({ settings });
|
|
} catch (error) {
|
|
console.error("Error fetching settings:", error);
|
|
return NextResponse.json(
|
|
{ error: "Failed to fetch settings" },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|
|
|
|
// PATCH /api/admin/settings - Update app settings
|
|
export async function PATCH(request: NextRequest) {
|
|
const { session, error } = await requireSuperAdmin();
|
|
if (error) return error;
|
|
|
|
try {
|
|
const body = await request.json();
|
|
const { settings } = body;
|
|
|
|
if (!settings || typeof settings !== "object") {
|
|
return NextResponse.json(
|
|
{ error: "Settings object is required" },
|
|
{ status: 400 }
|
|
);
|
|
}
|
|
|
|
// Update each setting
|
|
for (const [key, value] of Object.entries(settings)) {
|
|
// Get old value for audit
|
|
const oldResult = await pool.query(
|
|
'SELECT value FROM "app_settings" WHERE key = $1',
|
|
[key]
|
|
);
|
|
const oldValue = oldResult.rows[0]?.value;
|
|
|
|
await pool.query(
|
|
`INSERT INTO "app_settings" (id, key, value, updated_at)
|
|
VALUES ($1, $2, $3, NOW())
|
|
ON CONFLICT (key) DO UPDATE SET value = $3, updated_at = NOW()`,
|
|
[`setting_${key}`, key, value]
|
|
);
|
|
|
|
// Audit log
|
|
if (session?.user) {
|
|
await audit.settingsUpdated(
|
|
session.user.id,
|
|
session.user.email,
|
|
key,
|
|
oldValue,
|
|
value
|
|
);
|
|
}
|
|
}
|
|
|
|
return NextResponse.json({ success: true });
|
|
} catch (error) {
|
|
console.error("Error updating settings:", error);
|
|
return NextResponse.json(
|
|
{ error: "Failed to update settings" },
|
|
{ status: 500 }
|
|
);
|
|
}
|
|
}
|