feat: verschlüsselte Integrationseinstellungen, Haushaltsmitglieder mit Ersteller, Backup-Download

app/api/settings/integrations/route.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  getIntegrationStatus,
+  saveIntegrationSection,
+  validateIntegrationSection,
+  type IntegrationSection,
+} from "@/lib/integration-settings";
+import { canEncrypt } from "@/lib/settings-crypto";
+
+export async function GET() {
+  return NextResponse.json(await getIntegrationStatus());
+}
+
+export async function POST(req: NextRequest) {
+  const body = await req.json().catch(() => ({}));
+  const section = String(body.section ?? "");
+  const values = (body.values ?? {}) as Record<string, unknown>;
+  const errs = validateIntegrationSection(section, values);
+  if (errs.length) return NextResponse.json({ errors: errs }, { status: 400 });
+  const stringValues: Record<string, string> = {};
+  for (const [k, v] of Object.entries(values)) {
+    if (typeof v === "string") stringValues[k] = v;
+  }
+  const needsEncryption = Object.entries(stringValues).some(
+    ([k, v]) => v !== "" && (k === "smtp_pass" || k === "telegram_bot_token" || k === "logo_dev_secret_key")
+  );
+  if (needsEncryption && !canEncrypt()) {
+    return NextResponse.json(
+      { errors: ["verschluesselung"], message: "SETTINGS_ENCRYPTION_KEY fehlt (min. 32 Zeichen in .env)" },
+      { status: 503 }
+    );
+  }
+  const saved = await saveIntegrationSection(section as IntegrationSection, stringValues);
+  return NextResponse.json({ ok: true, saved, status: await getIntegrationStatus() });
+}