import { type NextRequest, NextResponse } from "next/server";
import { db, auditLogs } from "@epicure/db";
import { requireAdmin } from "@/lib/api-auth";
import { setSiteSetting, type SiteSettingKey } from "@/lib/site-settings";
import { randomUUID } from "crypto";

const ALLOWED_KEYS: SiteSettingKey[] = [
  "OPENAI_API_KEY",
  "ANTHROPIC_API_KEY",
  "OPENROUTER_API_KEY",
  "OPENROUTER_DEFAULT_MODEL",
  "OLLAMA_BASE_URL",
  "NEXT_PUBLIC_VAPID_PUBLIC_KEY",
  "VAPID_PRIVATE_KEY",
  "SIGNUPS_DISABLED",
  "DEFAULT_TEXT_PROVIDER",
  "DEFAULT_TEXT_MODEL",
  "DEFAULT_VISION_PROVIDER",
  "DEFAULT_VISION_MODEL",
  "DEFAULT_MEAL_PLAN_PROVIDER",
  "DEFAULT_MEAL_PLAN_MODEL",
  "DEFAULT_CHAT_PROVIDER",
  "DEFAULT_CHAT_MODEL",
  "AI_TOOL_CALLING_ENABLED",
  "GITEA_URL",
  "GITEA_TOKEN",
  "GITEA_REPO",
];

export async function PUT(req: NextRequest) {
  const { session, response } = await requireAdmin();
  if (response) return response;

  const body = (await req.json()) as Record<string, string | null>;

  const changed: string[] = [];
  for (const [key, value] of Object.entries(body)) {
    if (!ALLOWED_KEYS.includes(key as SiteSettingKey)) continue;
    await setSiteSetting(key as SiteSettingKey, value, session!.user.id);
    changed.push(key);
  }

  if (changed.length > 0) {
    await db.insert(auditLogs).values({
      id: randomUUID(),
      userId: session!.user.id,
      action: "admin.settings.update",
      targetType: "site_settings",
      metadata: JSON.stringify({ keys: changed }),
      createdAt: new Date(),
    });
  }

  return NextResponse.json({ ok: true });
}