feat: verschlüsselte Integrationseinstellungen, Haushaltsmitglieder mit Ersteller, Backup-Download

app/api/members/route.ts

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getDb } from "@/lib/db";
+
+export async function GET() {
+  const db = getDb();
+  const members = await db.householdMember.findMany({ orderBy: { name: "asc" } });
+  return NextResponse.json(members);
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({}));
+  const name = String(body.name ?? "").trim();
+  if (!name) return NextResponse.json({ errors: ["name"] }, { status: 400 });
+  if (name.length > 100) return NextResponse.json({ errors: ["name"] }, { status: 400 });
+  const db = getDb();
+  const existing = await db.householdMember.findUnique({ where: { name } });
+  if (existing) return NextResponse.json({ errors: ["name"] }, { status: 409 });
+  const created = await db.householdMember.create({ data: { name } });
+  return NextResponse.json(created, { status: 201 });
+}
+
+export async function DELETE(req: NextRequest) {
+  const id = Number(req.nextUrl.searchParams.get("id"));
+  if (!Number.isInteger(id)) return NextResponse.json({ error: "not found" }, { status: 404 });
+  const db = getDb();
+  const existing = await db.householdMember.findUnique({ where: { id } });
+  if (!existing) return NextResponse.json({ error: "not found" }, { status: 404 });
+  await db.householdMember.delete({ where: { id } });
+  return NextResponse.json({ ok: true });
+}

app/api/settings/backup/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from "next/server";
+import { randomBytes } from "crypto";
+import { unlink } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { getDb } from "@/lib/db";
+
+/**
+ * Lädt einen konsistenten SQLite-Snapshot herunter (VACUUM INTO läuft
+ * transaktional, auch bei parallelen Schreibzugriffen). Enthält Gutscheine,
+ * Kontakte, Mitglieder, Regeln, Logs und verschlüsselte Einstellungen.
+ * Wiederherstellen: Datei als /data/gutscheine.db ablegen (gleicher
+ * SETTINGS_ENCRYPTION_KEY erforderlich).
+ */
+export async function GET() {
+  const db = getDb();
+  const stamp = new Date().toISOString().slice(0, 16).replace(/[-:T]/g, "");
+  const tmpPath = join(tmpdir(), `gutscheintracker-backup-${stamp}-${randomBytes(4).toString("hex")}.db`);
+  try {
+    await db.$executeRawUnsafe(`VACUUM INTO '${tmpPath.replace(/'/g, "''")}'`);
+    const { readFile } = await import("fs/promises");
+    const data = await readFile(tmpPath);
+    await unlink(tmpPath).catch(() => {});
+    return new NextResponse(new Uint8Array(data), {
+      headers: {
+        "content-type": "application/x-sqlite3",
+        "content-disposition": `attachment; filename="gutscheintracker-backup-${stamp}.db"`,
+      },
+    });
+  } catch (e) {
+    await unlink(tmpPath).catch(() => {});
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "Backup fehlgeschlagen" },
+      { status: 500 }
+    );
+  }
+}

app/api/settings/integrations/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  getIntegrationStatus,
+  saveIntegrationSection,
+  validateIntegrationSection,
+  type IntegrationSection,
+} from "@/lib/integration-settings";
+import { canEncrypt } from "@/lib/settings-crypto";
+
+export async function GET() {
+  return NextResponse.json(await getIntegrationStatus());
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({}));
+  const section = String(body.section ?? "");
+  const values = (body.values ?? {}) as Record<string, unknown>;
+  const errs = validateIntegrationSection(section, values);
+  if (errs.length) return NextResponse.json({ errors: errs }, { status: 400 });
+  const stringValues: Record<string, string> = {};
+  for (const [k, v] of Object.entries(values)) {
+    if (typeof v === "string") stringValues[k] = v;
+  }
+  const needsEncryption = Object.entries(stringValues).some(
+    ([k, v]) => v !== "" && (k === "smtp_pass" || k === "telegram_bot_token" || k === "logo_dev_secret_key")
+  );
+  if (needsEncryption && !canEncrypt()) {
+    return NextResponse.json(
+      { errors: ["verschluesselung"], message: "SETTINGS_ENCRYPTION_KEY fehlt (min. 32 Zeichen in .env)" },
+      { status: 503 }
+    );
+  }
+  const saved = await saveIntegrationSection(section as IntegrationSection, stringValues);
+  return NextResponse.json({ ok: true, saved, status: await getIntegrationStatus() });
+}

app/api/vouchers/[id]/route.ts

@@ -9,7 +9,7 @@ export async function GET(_req: NextRequest, { params }: { params: Promise<{ id:
   const db = getDb();
   const v = await db.voucher.findUnique({ where: { id: numId }, include: { contacts: { include: { contact: true } } } });
   if (!v) return NextResponse.json({ error: "not found" }, { status: 404 });
-  return NextResponse.json(withLogoUrl(v));
+  return NextResponse.json(await withLogoUrl(v));
 }
 
 export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {

app/api/vouchers/route.ts

@@ -17,7 +17,7 @@ export async function GET(req: NextRequest) {
     if (filter === "aktiv") return s === "aktiv";
     return true;
   });
-  return NextResponse.json(filtered.map(withLogoUrl));
+  return NextResponse.json(await Promise.all(filtered.map(withLogoUrl)));
 }
 
 export async function POST(req: NextRequest) {
@@ -44,6 +44,14 @@ export async function POST(req: NextRequest) {
       return NextResponse.json({ errors: ["contactIds"] }, { status: 400 });
     }
   }
+  let createdBy: string | null = null;
+  if (body.memberId !== undefined && body.memberId !== null && String(body.memberId).trim() !== "") {
+    const memberId = Number(body.memberId);
+    if (!Number.isInteger(memberId)) return NextResponse.json({ errors: ["memberId"] }, { status: 400 });
+    const member = await db.householdMember.findUnique({ where: { id: memberId } });
+    if (!member) return NextResponse.json({ errors: ["memberId"] }, { status: 400 });
+    createdBy = member.name;
+  }
   const providerDomain = normalizeDomain(
     body.providerDomain === undefined || body.providerDomain === null ? null : String(body.providerDomain)
   );
@@ -72,6 +80,7 @@ export async function POST(req: NextRequest) {
       kategorie: input.kategorie,
       notiz: input.notiz,
       providerDomain,
+      createdBy,
       contacts: contactIds.length ? { create: contactIds.map((contactId) => ({ contactId })) } : undefined,
       rules: {
         create: reminderDays.map((tageVorher) => ({ tageVorher })),