From 8588eda3c9badb2a6c43e6b58c0f2c2558398b28 Mon Sep 17 00:00:00 2001
From: DanielS <daniel.schumacher@caspos.de>
Date: Tue, 18 Aug 2026 16:26:29 +0200
Subject: [PATCH] fix(api): improve error handling and auth check in smtp
 settings route

---
 shop/app/api/admin/smtp-settings/route.ts | 142 ++++++++++------------
 1 file changed, 61 insertions(+), 81 deletions(-)

diff --git a/shop/app/api/admin/smtp-settings/route.ts b/shop/app/api/admin/smtp-settings/route.ts
index 76d1f3c..8bd8922 100644
--- a/shop/app/api/admin/smtp-settings/route.ts
+++ b/shop/app/api/admin/smtp-settings/route.ts
@@ -1,96 +1,76 @@
 // API route for getting and updating SMTP settings (protected by admin check)
 import { NextResponse } from 'next/server';
-import { createServerClient } from '@supabase/ssr';
-import { cookies } from 'next/headers';
+import { verifyAdmin } from '@/lib/actions/auth';
+import { createAdminClient } from '@/lib/supabase/admin';
+import { createClient } from '@/lib/supabase/server';
+
 export async function GET() {
-    const cookieStore = await cookies();
+  try {
+    await verifyAdmin();
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message || 'Not authenticated' }, { status: 401 });
+  }
 
-  const supabaseUrl = process.env.SUPABASE_URL || process.env.NEXT_PUBLIC_SUPABASE_URL || '';
-  const supabase = createServerClient(
-    supabaseUrl,
-    process.env.SUPABASE_SERVICE_ROLE_KEY ?? '',
-    {
-      cookies: {
-        getAll() {
-          return cookieStore.getAll()
-        },
-        setAll(cookiesToSet) {
-          try {
-            cookiesToSet.forEach(({ name, value, options }) =>
-              cookieStore.set(name, value, options)
-            )
-          } catch {
-            // Kann in einer API-Route ignoriert werden, wenn nur gelesen wird
-          }
-        },
-      },
-      cookieOptions: {
-        name: "webshop-auth-token",
-      },
+  try {
+    let client: any;
+    try {
+      client = createAdminClient();
+    } catch {
+      client = await createClient();
     }
-  );
 
-  const { data: { user: authUser }, error: authError } = await supabase.auth.getUser();
-  if (authError || !authUser) {
-    return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
-  }
-  const { data: user } = await supabase.from('users').select('role').eq('id', authUser.id).single();
-  if (!user || user.role !== 'admin') {
-    return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 });
-  }
+    const { data, error } = await client
+      .from('settings')
+      .select('*')
+      .eq('id', 'smtp')
+      .maybeSingle();
 
-  const { data, error } = await supabase.from('settings').select('*').maybeSingle();
-  if (error) {
-    return NextResponse.json({ error: error.message }, { status: 500 });
+    if (error) {
+      console.error('Error fetching SMTP settings:', error);
+      return NextResponse.json({ 
+        settings: { host: '', port: 587, secure: false, user: '', pass: '' } 
+      });
+    }
+
+    return NextResponse.json({ 
+      settings: data || { host: '', port: 587, secure: false, user: '', pass: '' } 
+    });
+  } catch (err: any) {
+    console.error('SMTP settings GET error:', err);
+    return NextResponse.json({ 
+      settings: { host: '', port: 587, secure: false, user: '', pass: '' } 
+    });
   }
-  return NextResponse.json({ 
-    settings: data || { host: '', port: 587, secure: false, user: '', pass: '' } 
-  });
 }
 
 export async function POST(request: Request) {
-    const cookieStore = await cookies();
-
-    const supabaseUrl = process.env.SUPABASE_URL || process.env.NEXT_PUBLIC_SUPABASE_URL || '';
-    const supabase = createServerClient(
-      supabaseUrl,
-      process.env.SUPABASE_SERVICE_ROLE_KEY ?? '',
-      {
-        cookies: {
-          getAll() {
-            return cookieStore.getAll()
-          },
-          setAll(cookiesToSet) {
-            try {
-              cookiesToSet.forEach(({ name, value, options }) =>
-                cookieStore.set(name, value, options)
-              )
-            } catch {
-              // Kann in einer API-Route ignoriert werden, wenn nur gelesen wird
-            }
-          },
-        },
-        cookieOptions: {
-          name: "webshop-auth-token",
-        },
-      }
-    );
-
-  const { data: { user: authUser }, error: authError } = await supabase.auth.getUser();
-  if (authError || !authUser) {
-    return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
-  }
-  const { data: user } = await supabase.from('users').select('role').eq('id', authUser.id).single();
-  if (!user || user.role !== 'admin') {
-    return NextResponse.json({ error: 'Insufficient permissions' }, { status: 403 });
+  try {
+    await verifyAdmin();
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message || 'Not authenticated' }, { status: 401 });
   }
 
-  const payload = await request.json(); // expect {host, port, secure, user, pass}
-  const { error } = await supabase
-    .from('settings')
-    .upsert({ id: 'smtp', ...payload });
-  if (error) {
-    return NextResponse.json({ error: error.message }, { status: 500 });
+  try {
+    let client: any;
+    try {
+      client = createAdminClient();
+    } catch {
+      client = await createClient();
+    }
+
+    const payload = await request.json();
+    const { error } = await client
+      .from('settings')
+      .upsert({ id: 'smtp', ...payload });
+
+    if (error) {
+      console.error('Error saving SMTP settings:', error);
+      return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+
+    return NextResponse.json({ message: 'SMTP settings saved' });
+  } catch (err: any) {
+    console.error('SMTP settings POST error:', err);
+    return NextResponse.json({ error: err.message || 'Fehler beim Speichern' }, { status: 500 });
   }
-  return NextResponse.json({ message: 'SMTP settings saved' });
 }