@morphika/andami 0.1.2

package/app/api/admin/settings/route.ts

@@ -0,0 +1,279 @@
+import { NextRequest, NextResponse } from "next/server";
+import { isAdminAuthenticated } from "../../../../lib/auth";
+import { client } from "../../../../lib/sanity/client";
+import { writeClient } from "../../../../lib/sanity/writeClient";
+import { siteSettingsQuery } from "../../../../lib/sanity/queries";
+import { isSafeUrl, isBodyTooLarge, MAX_JSON_BODY_SIZE } from "../../../../lib/security";
+import { validateCsrf, csrfErrorResponse } from "../../../../lib/csrf";
+import { auditLog } from "../../../../lib/audit";
+import { getSiteConfig } from "../../../../lib/config";
+import { logger } from "../../../../lib/logger";
+
+/**
+ * GET /api/admin/settings — fetch siteSettings document
+ * POST /api/admin/settings — update siteSettings (authenticated)
+ */
+
+const SETTINGS_ID = "siteSettings";
+const cfg = getSiteConfig();
+
+export async function GET() {
+  const authenticated = await isAdminAuthenticated();
+  if (!authenticated) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    let settings = await client.fetch(siteSettingsQuery);
+
+    // Auto-create if missing
+    if (!settings) {
+      await writeClient.createIfNotExists({
+        _id: SETTINGS_ID,
+        _type: "siteSettings",
+        nav_items: [],
+        default_title: cfg.defaults.metaTitle,
+      });
+      settings = await client.fetch(siteSettingsQuery);
+    }
+
+    return NextResponse.json({ settings });
+  } catch (error) {
+    logger.error("[Admin:Settings]", "Failed to fetch settings:", error);
+    return NextResponse.json(
+      { error: "Failed to fetch settings" },
+      { status: 500 }
+    );
+  }
+}
+
+export async function POST(request: NextRequest) {
+  const authenticated = await isAdminAuthenticated();
+  if (!authenticated) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return NextResponse.json({ error: "Request body too large" }, { status: 413 });
+  }
+
+  try {
+    const body = await request.json();
+    const { section, data } = body;
+
+    if (!section || !data) {
+      return NextResponse.json(
+        { error: "Missing section or data" },
+        { status: 400 }
+      );
+    }
+
+    // Validate section name
+    const validSections = ["navigation", "nav_design", "metadata", "assets"];
+    if (!validSections.includes(section)) {
+      return NextResponse.json(
+        { error: "Invalid section" },
+        { status: 400 }
+      );
+    }
+
+    // Build patch based on section
+    let patch: Record<string, unknown> = {};
+
+    switch (section) {
+      case "navigation": {
+        // Validate nav_items structure
+        if (!Array.isArray(data.nav_items)) {
+          return NextResponse.json(
+            { error: "nav_items must be an array" },
+            { status: 400 }
+          );
+        }
+        // Check nav_items array length
+        if (data.nav_items.length > 50) {
+          return NextResponse.json(
+            { error: "nav_items exceeds maximum of 50 items" },
+            { status: 400 }
+          );
+        }
+        for (const item of data.nav_items) {
+          if (!item.label || typeof item.label !== "string") {
+            return NextResponse.json(
+              { error: "Each nav item must have a label" },
+              { status: 400 }
+            );
+          }
+          if (item.label.length > 1000) {
+            return NextResponse.json(
+              { error: "Nav item label exceeds maximum length of 1000 characters" },
+              { status: 400 }
+            );
+          }
+          if (!["internal", "external", "content"].includes(item.link_type)) {
+            return NextResponse.json(
+              { error: "link_type must be 'internal', 'external', or 'content'" },
+              { status: 400 }
+            );
+          }
+          // Validate external URLs — reject javascript:, data:, vbscript: etc.
+          if (item.link_type === "external" && item.external_url) {
+            if (!isSafeUrl(item.external_url)) {
+              return NextResponse.json(
+                { error: "External URL uses a disallowed protocol" },
+                { status: 400 }
+              );
+            }
+          }
+          // Validate content embed URLs
+          if (item.link_type === "content" && item.content_type === "video-embed" && item.content_url) {
+            if (!isSafeUrl(item.content_url)) {
+              return NextResponse.json(
+                { error: "Content embed URL uses a disallowed protocol" },
+                { status: 400 }
+              );
+            }
+          }
+        }
+        patch = {
+          nav_items: data.nav_items.map(
+            (item: {
+              _key?: string;
+              type?: string;
+              label: string;
+              logo_image?: string;
+              link_type: string;
+              internal_page?: { _ref: string };
+              external_url?: string;
+              content_type?: string;
+              content_asset?: string;
+              content_url?: string;
+              visible?: boolean;
+              grid_column?: number;
+              column_span?: number;
+              style_overrides?: Record<string, unknown>;
+            }) => ({
+              _key: item._key || crypto.randomUUID().slice(0, 8),
+              _type: "object",
+              type: item.type || "menu-item",
+              label: item.label,
+              ...(item.logo_image ? { logo_image: item.logo_image } : {}),
+              link_type: item.link_type,
+              ...(item.link_type === "internal" && item.internal_page
+                ? { internal_page: { _type: "reference", _ref: item.internal_page._ref } }
+                : {}),
+              ...(item.link_type === "external" && item.external_url
+                ? { external_url: item.external_url }
+                : {}),
+              ...(item.link_type === "content" ? {
+                ...(item.content_type ? { content_type: item.content_type } : {}),
+                ...(item.content_asset ? { content_asset: item.content_asset } : {}),
+                ...(item.content_url ? { content_url: item.content_url } : {}),
+              } : {}),
+              visible: item.visible !== false,
+              ...(typeof item.grid_column === "number" &&
+                item.grid_column >= 1 &&
+                item.grid_column <= 12
+                ? { grid_column: item.grid_column }
+                : {}),
+              column_span: typeof item.column_span === "number" && item.column_span >= 1
+                ? Math.min(item.column_span, 12)
+                : 1,
+              ...(item.style_overrides && Object.keys(item.style_overrides).length > 0
+                ? { style_overrides: item.style_overrides }
+                : {}),
+            })
+          ),
+        };
+        break;
+      }
+
+      case "nav_design": {
+        const nd = data.nav_design || {};
+        patch = {
+          nav_design: {
+            _type: "object",
+            logo_text: typeof nd.logo_text === "string" ? nd.logo_text.slice(0, 200) : cfg.defaults.logoText,
+            color: ["yellow-lime", "yellow", "red-coral", "blue", "green", "white"].includes(nd.color) ? nd.color : "yellow-lime",
+            position: ["fixed", "sticky", "static"].includes(nd.position) ? nd.position : "fixed",
+            hide_on_scroll: nd.hide_on_scroll !== false,
+            font_size: typeof nd.font_size === "number" ? Math.max(8, Math.min(48, nd.font_size)) : 14,
+            font_family: typeof nd.font_family === "string" ? nd.font_family.slice(0, 200) : "",
+            text_align: ["left", "center", "right"].includes(nd.text_align) ? nd.text_align : "left",
+            text_transform: ["none", "uppercase", "lowercase", "capitalize"].includes(nd.text_transform) ? nd.text_transform : "uppercase",
+            padding_h: typeof nd.padding_h === "number" ? Math.max(0, Math.min(200, nd.padding_h)) : 24,
+            padding_v: typeof nd.padding_v === "number" ? Math.max(0, Math.min(200, nd.padding_v)) : 27,
+            margin_h: typeof nd.margin_h === "number" ? Math.max(0, Math.min(200, nd.margin_h)) : 0,
+            margin_v: typeof nd.margin_v === "number" ? Math.max(0, Math.min(200, nd.margin_v)) : 0,
+            background_color: typeof nd.background_color === "string" ? nd.background_color.slice(0, 50) : "",
+            background_opacity: typeof nd.background_opacity === "number" ? Math.max(0, Math.min(100, nd.background_opacity)) : 0,
+            backdrop_blur: !!nd.backdrop_blur,
+            items_gap: typeof nd.items_gap === "number" ? Math.max(0, Math.min(200, nd.items_gap)) : 32,
+            logo_columns: typeof nd.logo_columns === "number" ? Math.max(1, Math.min(6, Math.round(nd.logo_columns))) : 3,
+            vertical_align: ["top", "middle", "bottom"].includes(nd.vertical_align) ? nd.vertical_align : "top",
+            font_weight: typeof nd.font_weight === "string" ? nd.font_weight.slice(0, 10) : "400",
+            // ── Entrance animation ──
+            entrance_animation: ["", "fade-in", "slide-down", "blur-in"].includes(nd.entrance_animation) ? nd.entrance_animation : "",
+            entrance_duration: typeof nd.entrance_duration === "number" ? Math.max(200, Math.min(5000, nd.entrance_duration)) : 600,
+            entrance_delay: typeof nd.entrance_delay === "number" ? Math.max(0, Math.min(5000, nd.entrance_delay)) : 0,
+            entrance_stagger: !!nd.entrance_stagger,
+            entrance_stagger_delay: typeof nd.entrance_stagger_delay === "number" ? Math.max(20, Math.min(500, nd.entrance_stagger_delay)) : 80,
+          },
+        };
+        break;
+      }
+
+      case "metadata": {
+        // Validate text field lengths
+        if (data.default_title && typeof data.default_title === "string" && data.default_title.length > 1000) {
+          return NextResponse.json(
+            { error: "Title field exceeds maximum length of 1000 characters" },
+            { status: 400 }
+          );
+        }
+        if (data.default_description && typeof data.default_description === "string" && data.default_description.length > 1000) {
+          return NextResponse.json(
+            { error: "Description field exceeds maximum length of 1000 characters" },
+            { status: 400 }
+          );
+        }
+        patch = {
+          default_title: data.default_title || "",
+          default_description: data.default_description || "",
+          default_og_image: data.default_og_image || "",
+          favicon_path: data.favicon_path || "",
+          analytics_id: data.analytics_id || "",
+        };
+        break;
+      }
+
+      case "assets": {
+        patch = {};
+        if (data.asset_base_url !== undefined) {
+          patch.asset_base_url = data.asset_base_url;
+        }
+        break;
+      }
+    }
+
+    // Ensure the document exists before patching
+    await writeClient.createIfNotExists({
+      _id: SETTINGS_ID,
+      _type: "siteSettings",
+    });
+
+    // Apply the patch
+    await writeClient.patch(SETTINGS_ID).set(patch).commit();
+
+    auditLog("settings.update", { section });
+
+    return NextResponse.json({ success: true, section });
+  } catch (error) {
+    logger.error("[Admin:Settings]", "Failed to save settings:", error);
+    return NextResponse.json(
+      { error: "Failed to save settings" },
+      { status: 500 }
+    );
+  }
+}

package/app/api/admin/setup/complete/route.ts

@@ -0,0 +1,51 @@
+import { NextRequest, NextResponse } from "next/server";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { client } from "../../../../../lib/sanity/client";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { auditLog } from "../../../../../lib/audit";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * POST /api/admin/setup/complete — Mark setup wizard as complete.
+ *
+ * Sets `setup_complete: true` on the siteSettings document.
+ * Called when the user clicks "Start Building" on the final wizard step.
+ * This prevents the wizard from re-triggering on subsequent admin visits.
+ */
+export async function POST(request: NextRequest) {
+  const authenticated = await isAdminAuthenticated();
+  if (!authenticated) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+
+  try {
+    // Find the siteSettings document
+    const doc = await client.fetch<{ _id: string } | null>(
+      `*[_type == "siteSettings"][0]{ _id }`
+    );
+
+    if (!doc) {
+      return NextResponse.json(
+        { error: "siteSettings document not found. Run database setup first." },
+        { status: 400 }
+      );
+    }
+
+    // Set the completion flag
+    await writeClient.patch(doc._id).set({ setup_complete: true }).commit();
+
+    auditLog("setup.complete", {});
+    logger.info("[Setup]", "Setup wizard marked as complete");
+
+    return NextResponse.json({ success: true });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Failed to complete setup";
+    logger.error("[Setup]", "Failed to mark setup complete:", err);
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/app/api/admin/setup/route.ts

@@ -0,0 +1,118 @@
+import { NextRequest, NextResponse } from "next/server";
+import { isAdminAuthenticated } from "../../../../lib/auth";
+import { getSetupStatus } from "../../../../lib/setup/detect";
+import { client } from "../../../../lib/sanity/client";
+import { writeClient } from "../../../../lib/sanity/writeClient";
+import { validateCsrf, csrfErrorResponse } from "../../../../lib/csrf";
+
+/**
+ * GET /api/admin/setup — Returns current setup/onboarding status.
+ * Used by the admin layout to decide whether to show the wizard,
+ * and by the wizard itself to know which steps are already done.
+ */
+export async function GET() {
+  const authenticated = await isAdminAuthenticated();
+  if (!authenticated) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  try {
+    const status = await getSetupStatus();
+    return NextResponse.json(status);
+  } catch {
+    return NextResponse.json(
+      { error: "Failed to check setup status" },
+      { status: 500 }
+    );
+  }
+}
+
+/**
+ * POST /api/admin/setup — Seed initial Sanity documents.
+ * Called by the wizard's Database step after a successful connection test.
+ * Creates siteSettings, siteStyles, and assetRegistry if they don't exist.
+ */
+export async function POST(request: NextRequest) {
+  const authenticated = await isAdminAuthenticated();
+  if (!authenticated) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+
+  try {
+    // Check which documents already exist
+    const existing = await client.fetch<{
+      siteSettings: number;
+      siteStyles: number;
+      assetRegistry: number;
+    }>(`{
+      "siteSettings": count(*[_type == "siteSettings"]),
+      "siteStyles": count(*[_type == "siteStyles"]),
+      "assetRegistry": count(*[_type == "assetRegistry"])
+    }`);
+
+    const seeded: string[] = [];
+    const skipped: string[] = [];
+
+    // Seed siteSettings
+    if (existing.siteSettings === 0) {
+      await writeClient.create({
+        _type: "siteSettings",
+        site_title: "",
+        site_description: "",
+        nav_items: [],
+        nav_design: {
+          position: "fixed",
+          hide_on_scroll: true,
+          font_size: 14,
+          padding_h: 24,
+          padding_v: 27,
+          margin_h: 0,
+          margin_v: 0,
+          background_opacity: 100,
+          backdrop_blur: false,
+          items_gap: 32,
+        },
+      });
+      seeded.push("siteSettings");
+    } else {
+      skipped.push("siteSettings");
+    }
+
+    // Seed siteStyles
+    if (existing.siteStyles === 0) {
+      await writeClient.create({
+        _type: "siteStyles",
+        grid_columns: 12,
+        grid_width: 1200,
+        grid_gutter: 24,
+        fonts: [],
+        color_palette: [],
+        typography: {},
+      });
+      seeded.push("siteStyles");
+    } else {
+      skipped.push("siteStyles");
+    }
+
+    // Seed assetRegistry
+    if (existing.assetRegistry === 0) {
+      await writeClient.create({
+        _type: "assetRegistry",
+        assets: [],
+        storage_provider: "",
+      });
+      seeded.push("assetRegistry");
+    } else {
+      skipped.push("assetRegistry");
+    }
+
+    return NextResponse.json({ seeded, skipped });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Seeding failed";
+    return NextResponse.json({ error: message }, { status: 500 });
+  }
+}

package/app/api/admin/storage/switch/route.ts

@@ -0,0 +1,117 @@
+import { NextRequest, NextResponse } from "next/server";
+import { revalidatePath } from "next/cache";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { client } from "../../../../../lib/sanity/client";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { isBodyTooLarge, MAX_JSON_BODY_SIZE, jsonError } from "../../../../../lib/security";
+import { invalidateProviderConfigCache } from "../../../../../lib/storage";
+import { auditLog } from "../../../../../lib/audit";
+import type { StorageProvider } from "../../../../../lib/storage/types";
+import { logger } from "../../../../../lib/logger";
+
+const VALID_PROVIDERS: StorageProvider[] = ["r2"];
+
+/**
+ * POST /api/admin/storage/switch — Switch the active storage provider.
+ *
+ * Body: { provider: "r2" }
+ *
+ * 1. Validates the target provider is connected (has credentials).
+ * 2. Updates `assetRegistry.storage_provider` in Sanity.
+ * 3. Invalidates the in-memory provider config cache.
+ * 4. Triggers ISR revalidation of the entire site layout so all
+ *    server-rendered pages pick up the new asset URLs.
+ *
+ * The switch assumes providers have the same files at the same
+ * relative paths. No automatic data migration occurs.
+ *
+ * Currently only R2 is supported. The route is preserved for the
+ * multi-provider architecture — new providers can be added here.
+ */
+export async function POST(request: NextRequest) {
+  if (!(await isAdminAuthenticated())) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+  if (isBodyTooLarge(request, MAX_JSON_BODY_SIZE)) {
+    return jsonError("Request body too large", 413);
+  }
+
+  try {
+    const body = await request.json();
+    const { provider } = body;
+
+    // ── Validate provider value ──
+    if (!provider || !VALID_PROVIDERS.includes(provider)) {
+      return jsonError(
+        `Invalid provider. Must be one of: ${VALID_PROVIDERS.join(", ")}`,
+        400
+      );
+    }
+
+    // ── Check current provider (avoid no-op) ──
+    const registry = await client.fetch(
+      `*[_type == "assetRegistry"][0]{
+        storage_provider,
+        r2_bucket_url,
+        r2_access_key_id,
+        r2_endpoint,
+        r2_bucket_name,
+        r2_connected_at
+      }`
+    );
+
+    const currentProvider = registry?.storage_provider || "r2";
+    if (currentProvider === provider) {
+      return NextResponse.json({
+        success: true,
+        provider,
+        message: `Already using ${provider}`,
+        revalidated: false,
+      });
+    }
+
+    // ── Validate target provider is connected ──
+    if (provider === "r2") {
+      if (!registry?.r2_access_key_id || !registry?.r2_bucket_url || !registry?.r2_endpoint || !registry?.r2_bucket_name) {
+        return jsonError(
+          "Cannot switch to R2: not connected. Please connect R2 first via the Storage page.",
+          400
+        );
+      }
+    }
+
+    // ── Update active provider in Sanity ──
+    await writeClient
+      .patch("assetRegistry")
+      .set({ storage_provider: provider })
+      .commit();
+
+    // ── Invalidate server-side provider cache ──
+    invalidateProviderConfigCache();
+
+    // ── Revalidate the entire site so pages pick up new asset URLs ──
+    revalidatePath("/", "layout");
+
+    auditLog("storage.switch", {
+      from: currentProvider,
+      to: provider,
+    });
+
+    return NextResponse.json({
+      success: true,
+      provider,
+      previousProvider: currentProvider,
+      revalidated: true,
+    });
+  } catch (err) {
+    logger.error("[Admin:Storage]", "Failed to switch storage provider:", err);
+    return NextResponse.json(
+      { error: "Failed to switch storage provider" },
+      { status: 500 }
+    );
+  }
+}

package/app/api/admin/styles/fonts/route.ts

@@ -0,0 +1,97 @@
+import { NextRequest, NextResponse } from "next/server";
+import { isAdminAuthenticated } from "../../../../../lib/auth";
+import { writeClient } from "../../../../../lib/sanity/writeClient";
+import { validateFontMagicBytes } from "../../../../../lib/security";
+import { validateCsrf, csrfErrorResponse } from "../../../../../lib/csrf";
+import { logger } from "../../../../../lib/logger";
+
+/**
+ * POST /api/admin/styles/fonts — Upload a font file to Sanity CDN
+ *
+ * Accepts multipart/form-data with a single font file (.woff2, .woff, .ttf, .otf).
+ * Validates both file extension AND magic bytes to prevent malicious uploads.
+ * Returns the Sanity CDN URL and asset ID for storing in the siteStyles document.
+ */
+
+const ALLOWED_EXTENSIONS = [".woff2", ".woff", ".ttf", ".otf"];
+const MIME_MAP: Record<string, string> = {
+  ".woff2": "font/woff2",
+  ".woff": "font/woff",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+};
+const MAX_FONT_SIZE = 5 * 1024 * 1024; // 5MB
+
+export async function POST(request: NextRequest) {
+  const authenticated = await isAdminAuthenticated();
+  if (!authenticated) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (!validateCsrf(request)) {
+    return csrfErrorResponse();
+  }
+
+  try {
+    const formData = await request.formData();
+    const file = formData.get("font") as File | null;
+
+    if (!file) {
+      return NextResponse.json(
+        { error: "No font file provided" },
+        { status: 400 }
+      );
+    }
+
+    // Validate extension
+    const filename = file.name.toLowerCase();
+    const ext = filename.substring(filename.lastIndexOf("."));
+    if (!ALLOWED_EXTENSIONS.includes(ext)) {
+      return NextResponse.json(
+        { error: "Invalid file type. Allowed: .woff2, .woff, .ttf, .otf" },
+        { status: 400 }
+      );
+    }
+
+    // Validate file size (max 5MB)
+    if (file.size > MAX_FONT_SIZE) {
+      return NextResponse.json(
+        { error: "Font file too large. Maximum 5MB." },
+        { status: 400 }
+      );
+    }
+
+    // Read file content
+    const arrayBuffer = await file.arrayBuffer();
+
+    // Validate magic bytes — ensure file content matches the claimed extension
+    if (!validateFontMagicBytes(arrayBuffer, ext)) {
+      return NextResponse.json(
+        { error: "File content does not match the expected font format" },
+        { status: 400 }
+      );
+    }
+
+    // Convert to Buffer for Sanity upload
+    const buffer = Buffer.from(arrayBuffer);
+
+    // Upload to Sanity CDN with correct Content-Type
+    const asset = await writeClient.assets.upload("file", buffer, {
+      filename: file.name,
+      contentType: MIME_MAP[ext] || "application/octet-stream",
+    });
+
+    return NextResponse.json({
+      success: true,
+      file_url: asset.url,
+      file_id: asset._id,
+      original_filename: file.name,
+      size: file.size,
+    });
+  } catch (error) {
+    logger.error("[Admin:Styles]", "Failed to upload font:", error);
+    return NextResponse.json(
+      { error: "Failed to upload font file" },
+      { status: 500 }
+    );
+  }
+}