30 lines
1.1 KiB
JavaScript
30 lines
1.1 KiB
JavaScript
import { requireAuth } from '../auth.js'
|
|
import { pool } from '../db.js'
|
|
|
|
const ALLOWED_KEYS = new Set(['forecasting_url', 'forecasting_api_key'])
|
|
|
|
export async function settingsRoutes(fastify) {
|
|
fastify.addHook('preHandler', requireAuth)
|
|
|
|
fastify.get('/api/settings', async (request, reply) => {
|
|
if (!request.user?.is_admin) return reply.status(403).send({ error: 'Admin only' })
|
|
const res = await pool.query('SELECT key, value, updated_at FROM app_settings ORDER BY key')
|
|
return { settings: res.rows }
|
|
})
|
|
|
|
fastify.put('/api/settings', async (request, reply) => {
|
|
if (!request.user?.is_admin) return reply.status(403).send({ error: 'Admin only' })
|
|
const { settings } = request.body || {}
|
|
if (!Array.isArray(settings)) return reply.status(400).send({ error: 'settings must be an array' })
|
|
|
|
for (const { key, value } of settings) {
|
|
if (!ALLOWED_KEYS.has(key)) continue
|
|
await pool.query(
|
|
`INSERT INTO app_settings (key, value, updated_at) VALUES ($1, $2, NOW())
|
|
ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()`,
|
|
[key, value ?? '']
|
|
)
|
|
}
|
|
return { ok: true }
|
|
})
|
|
}
|