HealthLog/src/app/api/insights/settings/route.ts

import { prisma } from "@/lib/db";
import { apiSuccess, apiError, safeJson } from "@/lib/api-response";
import { NextRequest } from "next/server";
import { apiHandler, requireAuth } from "@/lib/api-handler";
import { annotate } from "@/lib/logging/context";

export const GET = apiHandler(async () => {
  const { user } = await requireAuth();

  const dbUser = await prisma.user.findUnique({
    where: { id: user.id },
    select: {
      codexConnectionStatus: true,
      codexConnectedAt: true,
      insightsPrivacyMode: true,
      insightsCachedAt: true,
    },
  });

  const settings = await prisma.appSettings.findUnique({
    where: { id: "singleton" },
    select: { adminAiKeyEncrypted: true },
  });

  annotate({ action: { name: "insights.settings.get" } });

  return apiSuccess({
    codexStatus: dbUser?.codexConnectionStatus ?? "disconnected",
    codexConnectedAt: dbUser?.codexConnectedAt ?? null,
    hasAdminKey: !!settings?.adminAiKeyEncrypted,
    privacyMode: dbUser?.insightsPrivacyMode ?? "aggregated",
    lastInsightAt: dbUser?.insightsCachedAt ?? null,
  });
});

export const PUT = apiHandler(async (request: NextRequest) => {
  const { user } = await requireAuth();

  const { data: body, error: jsonError } = await safeJson<Record<string, unknown>>(request);
  if (jsonError) return jsonError;

  const data: Record<string, unknown> = {};

  if (typeof body.privacyMode === "string") {
    const mode = body.privacyMode as string;
    if (!["aggregated", "raw"].includes(mode)) {
      return apiError("Invalid privacy mode", 422);
    }
    data.insightsPrivacyMode = mode;
    data.insightsCachedAt = null;
    data.insightsCachedText = null;
  }

  if (Object.keys(data).length === 0) {
    return apiError("No changes", 422);
  }

  await prisma.user.update({
    where: { id: user.id },
    data,
  });

  annotate({ action: { name: "insights.settings.update" } });

  return apiSuccess({ updated: true });
});