homeio

1import { NextResponse } from "next/server";
2import type { NextRequest } from "next/server";
3import {
4  createRequestId,
5  logServerAction,
6  withServerTiming,
7} from "@/lib/server/logging/logger";
8import {
9  getSystemSecuritySettings,
10  updateSystemSecuritySettings,
11} from "@/lib/server/modules/system/security-service";
12import type { SystemSecuritySettings } from "@/lib/shared/contracts/system";
13import { requireApiSession } from "@/lib/server/modules/auth/api";
14
15export const runtime = "nodejs";
16
17function isSystemSecurityPayload(value: unknown): value is SystemSecuritySettings {
18  if (!value || typeof value !== "object") return false;
19  const payload = value as Partial<SystemSecuritySettings>;
20  return (
21    typeof payload.firewallEnabled === "boolean" &&
22    typeof payload.firewallIncomingPolicy === "string" &&
23    typeof payload.firewallOutgoingPolicy === "string" &&
24    typeof payload.fail2banEnabled === "boolean" &&
25    typeof payload.fail2banMaxRetries === "number" &&
26    typeof payload.fail2banBanDurationSeconds === "number"
27  );
28}
29
30function isValidationError(error: unknown) {
31  return error instanceof Error && error.message.toLowerCase().includes("invalid");
32}
33
34export async function GET(request: NextRequest) {
35  const apiSession = await requireApiSession(request);
36  if (apiSession.response) return apiSession.response;
37  const requestId = createRequestId();
38
39  try {
40    return await withServerTiming(
41      {
42        layer: "api",
43        action: "system.security.get",
44        requestId,
45      },
46      async () => {
47        const session = apiSession.session;
48
49        const settings = await getSystemSecuritySettings();
50
51        logServerAction({
52          layer: "api",
53          action: "system.security.get.read",
54          status: "success",
55          requestId,
56          message: "Loaded system security settings",
57          meta: {
58            userId: session.userId,
59            username: session.username,
60            firewallEnabled: settings.firewallEnabled,
61            firewallIncomingPolicy: settings.firewallIncomingPolicy,
62            firewallOutgoingPolicy: settings.firewallOutgoingPolicy,
63            fail2banEnabled: settings.fail2banEnabled,
64            fail2banMaxRetries: settings.fail2banMaxRetries,
65            fail2banBanDurationSeconds: settings.fail2banBanDurationSeconds,
66          },
67        });
68
69        return NextResponse.json({ data: settings });
70      },
71    );
72  } catch (error) {
73    logServerAction({
74      level: "error",
75      layer: "api",
76      action: "system.security.get.response",
77      status: "error",
78      requestId,
79      message: "Failed to load system security settings",
80      error,
81    });
82
83    return NextResponse.json({ error: "Failed to load security settings" }, { status: 500 });
84  }
85}
86
87export async function PUT(request: NextRequest) {
88  const apiSession = await requireApiSession(request);
89  if (apiSession.response) return apiSession.response;
90  const requestId = createRequestId();
91
92  try {
93    return await withServerTiming(
94      {
95        layer: "api",
96        action: "system.security.put",
97        requestId,
98      },
99      async () => {
100        const session = apiSession.session;
101
102        const body = await request.json().catch(() => null);
103        if (!isSystemSecurityPayload(body)) {
104          return NextResponse.json({ error: "Invalid system security payload" }, { status: 400 });
105        }
106
107        try {
108          const settings = await updateSystemSecuritySettings(body);
109
110          logServerAction({
111            layer: "api",
112            action: "system.security.put.updated",
113            status: "success",
114            requestId,
115            message: "Updated system security settings",
116            meta: {
117              userId: session.userId,
118              username: session.username,
119              firewallEnabled: settings.firewallEnabled,
120              firewallIncomingPolicy: settings.firewallIncomingPolicy,
121              firewallOutgoingPolicy: settings.firewallOutgoingPolicy,
122              fail2banEnabled: settings.fail2banEnabled,
123              fail2banMaxRetries: settings.fail2banMaxRetries,
124              fail2banBanDurationSeconds: settings.fail2banBanDurationSeconds,
125            },
126          });
127
128          return NextResponse.json({ data: settings });
129        } catch (error) {
130          if (isValidationError(error)) {
131            return NextResponse.json({ error: (error as Error).message }, { status: 400 });
132          }
133          throw error;
134        }
135      },
136    );
137  } catch (error) {
138    logServerAction({
139      level: "error",
140      layer: "api",
141      action: "system.security.put.response",
142      status: "error",
143      requestId,
144      message: "Failed to update system security settings",
145      error,
146    });
147
148    return NextResponse.json({ error: "Failed to update security settings" }, { status: 500 });
149  }
150}
151