feat: verschlüsselte Integrationseinstellungen, Haushaltsmitglieder mit Ersteller, Backup-Download

app/api/settings/backup/route.ts

@@ -0,0 +1,37 @@
+import { NextResponse } from "next/server";
+import { randomBytes } from "crypto";
+import { unlink } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { getDb } from "@/lib/db";
+
+/**
+ * Lädt einen konsistenten SQLite-Snapshot herunter (VACUUM INTO läuft
+ * transaktional, auch bei parallelen Schreibzugriffen). Enthält Gutscheine,
+ * Kontakte, Mitglieder, Regeln, Logs und verschlüsselte Einstellungen.
+ * Wiederherstellen: Datei als /data/gutscheine.db ablegen (gleicher
+ * SETTINGS_ENCRYPTION_KEY erforderlich).
+ */
+export async function GET() {
+  const db = getDb();
+  const stamp = new Date().toISOString().slice(0, 16).replace(/[-:T]/g, "");
+  const tmpPath = join(tmpdir(), `gutscheintracker-backup-${stamp}-${randomBytes(4).toString("hex")}.db`);
+  try {
+    await db.$executeRawUnsafe(`VACUUM INTO '${tmpPath.replace(/'/g, "''")}'`);
+    const { readFile } = await import("fs/promises");
+    const data = await readFile(tmpPath);
+    await unlink(tmpPath).catch(() => {});
+    return new NextResponse(new Uint8Array(data), {
+      headers: {
+        "content-type": "application/x-sqlite3",
+        "content-disposition": `attachment; filename="gutscheintracker-backup-${stamp}.db"`,
+      },
+    });
+  } catch (e) {
+    await unlink(tmpPath).catch(() => {});
+    return NextResponse.json(
+      { error: e instanceof Error ? e.message : "Backup fehlgeschlagen" },
+      { status: 500 }
+    );
+  }
+}

app/api/settings/integrations/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  getIntegrationStatus,
+  saveIntegrationSection,
+  validateIntegrationSection,
+  type IntegrationSection,
+} from "@/lib/integration-settings";
+import { canEncrypt } from "@/lib/settings-crypto";
+
+export async function GET() {
+  return NextResponse.json(await getIntegrationStatus());
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({}));
+  const section = String(body.section ?? "");
+  const values = (body.values ?? {}) as Record<string, unknown>;
+  const errs = validateIntegrationSection(section, values);
+  if (errs.length) return NextResponse.json({ errors: errs }, { status: 400 });
+  const stringValues: Record<string, string> = {};
+  for (const [k, v] of Object.entries(values)) {
+    if (typeof v === "string") stringValues[k] = v;
+  }
+  const needsEncryption = Object.entries(stringValues).some(
+    ([k, v]) => v !== "" && (k === "smtp_pass" || k === "telegram_bot_token" || k === "logo_dev_secret_key")
+  );
+  if (needsEncryption && !canEncrypt()) {
+    return NextResponse.json(
+      { errors: ["verschluesselung"], message: "SETTINGS_ENCRYPTION_KEY fehlt (min. 32 Zeichen in .env)" },
+      { status: 503 }
+    );
+  }
+  const saved = await saveIntegrationSection(section as IntegrationSection, stringValues);
+  return NextResponse.json({ ok: true, saved, status: await getIntegrationStatus() });
+}