362f65656b
Full audit (bugs/UI-UX/backend/feature-gap) turned up a money-leak AI quota bypass, webhook SSRF, and a long tail of missing pagination/auth/a11y work. Fixes land together since HANDOFF.md tracked them as one backlog. - AI routes charge tier quota before generating; nutrition POST is author-only - Webhook dispatch re-validates URL per delivery (SSRF/DNS-rebinding), treats redirects as failures; recipe.published now actually dispatches - New indexes/unique constraints on recipes, meal-planning, comments FK cascade - Recipe PUT/restore snapshot only inside the transaction, after validation - Recipe DELETE cleans up S3 objects (recipe + review photos) - Optimistic UI (favorite/star/follow/shopping-list) rolls back on failure - Upload presign enforces file size cap + per-tier storage quota - Route-level loading/error/not-found states across (app), admin, and root - middleware.ts guards (app)/admin; requireAdmin checks DB role, not cached session; rate limiting applied to both session and API-key branches, bucketed per key; Stripe webhook dedupes by event id - Pagination added to recipes, feed, profile, comments, pantry, admin tables - Nav shows real avatar + profile link + dark-mode toggle; destructive actions standardized on AlertDialog - Unsaved-changes guard + real ingredient/step validation on recipe form; canonical /recipes/[id] used in-app; next/image migration; aria-labels and alt text across icon buttons, avatars, recipe photos - packages/api-types removed (zero callers, too drifted to safely rewire); openapi.ts and ai-keys error shape drift fixed; BYOK decrypt failures now surface instead of silently falling back to the platform key Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
135 lines
4.3 KiB
TypeScript
135 lines
4.3 KiB
TypeScript
"use client";
|
|
|
|
import { useState } from "react";
|
|
import { toast } from "sonner";
|
|
import { Button } from "@/components/ui/button";
|
|
import { Input } from "@/components/ui/input";
|
|
import { Label } from "@/components/ui/label";
|
|
import { Badge } from "@/components/ui/badge";
|
|
import { Eye, EyeOff } from "lucide-react";
|
|
|
|
type SettingMeta = {
|
|
value: string | null;
|
|
isSecret: boolean;
|
|
fromDb: boolean;
|
|
};
|
|
|
|
type Group = {
|
|
title: string;
|
|
description: string;
|
|
keys: readonly string[];
|
|
};
|
|
|
|
export function AdminSettingsForm({
|
|
group,
|
|
settings,
|
|
}: {
|
|
group: Group;
|
|
settings: Record<string, SettingMeta>;
|
|
}) {
|
|
const [values, setValues] = useState<Record<string, string>>(() =>
|
|
Object.fromEntries(
|
|
group.keys.map((k) => [k, settings[k]?.isSecret && settings[k]?.value ? "" : (settings[k]?.value ?? "")])
|
|
)
|
|
);
|
|
const [showSecret, setShowSecret] = useState<Record<string, boolean>>({});
|
|
const [saving, setSaving] = useState(false);
|
|
|
|
async function handleSave() {
|
|
setSaving(true);
|
|
try {
|
|
const res = await fetch("/api/v1/admin/settings", {
|
|
method: "PUT",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify(
|
|
Object.fromEntries(group.keys.map((k) => [k, values[k] || null]))
|
|
),
|
|
});
|
|
if (!res.ok) throw new Error("Save failed");
|
|
toast.success("Settings saved");
|
|
} catch {
|
|
toast.error("Failed to save settings");
|
|
} finally {
|
|
setSaving(false);
|
|
}
|
|
}
|
|
|
|
return (
|
|
<section className="rounded-xl border p-6 space-y-4">
|
|
<div>
|
|
<h2 className="font-semibold text-lg">{group.title}</h2>
|
|
<p className="text-sm text-muted-foreground mt-1">{group.description}</p>
|
|
</div>
|
|
|
|
<div className="space-y-4">
|
|
{group.keys.map((key) => {
|
|
const meta = settings[key];
|
|
const isSecret = meta?.isSecret ?? false;
|
|
const fromDb = meta?.fromDb ?? false;
|
|
const hasValue = !!meta?.value;
|
|
const revealed = showSecret[key];
|
|
|
|
return (
|
|
<div key={key} className="space-y-1.5">
|
|
<div className="flex items-center gap-2">
|
|
<Label className="font-mono text-xs">{key}</Label>
|
|
{hasValue && (
|
|
<Badge variant={fromDb ? "default" : "secondary"} className="text-xs">
|
|
{fromDb ? "DB override" : "from .env"}
|
|
</Badge>
|
|
)}
|
|
{!hasValue && (
|
|
<Badge variant="outline" className="text-xs text-muted-foreground">
|
|
not set
|
|
</Badge>
|
|
)}
|
|
</div>
|
|
<div className="flex gap-2">
|
|
<Input
|
|
type={isSecret && !revealed ? "password" : "text"}
|
|
placeholder={
|
|
isSecret && hasValue
|
|
? "Enter new value to replace (leave blank to keep current)"
|
|
: `Enter ${key}`
|
|
}
|
|
value={values[key] ?? ""}
|
|
onChange={(e) => setValues((prev) => ({ ...prev, [key]: e.target.value }))}
|
|
className="font-mono text-sm"
|
|
/>
|
|
{isSecret && (
|
|
<Button
|
|
type="button"
|
|
variant="outline"
|
|
size="icon"
|
|
onClick={() => setShowSecret((prev) => ({ ...prev, [key]: !prev[key] }))}
|
|
aria-label={revealed ? "Hide value" : "Show value"}
|
|
>
|
|
{revealed ? <EyeOff className="h-4 w-4" /> : <Eye className="h-4 w-4" />}
|
|
</Button>
|
|
)}
|
|
{fromDb && (
|
|
<Button
|
|
type="button"
|
|
variant="outline"
|
|
size="sm"
|
|
onClick={() => {
|
|
setValues((prev) => ({ ...prev, [key]: "" }));
|
|
}}
|
|
className="text-destructive hover:text-destructive shrink-0"
|
|
>
|
|
Clear
|
|
</Button>
|
|
)}
|
|
</div>
|
|
</div>
|
|
);
|
|
})}
|
|
</div>
|
|
|
|
<Button onClick={() => { void handleSave(); }} disabled={saving} size="sm">
|
|
{saving ? "Saving…" : "Save"}
|
|
</Button>
|
|
</section>
|
|
);
|
|
}
|