Feat/mobile backend

.github/workflows/test.yml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12" # pinned to match the committed bun.lock
 
       - name: Install canvas build deps
         run: sudo apt-get update && sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
@@ -68,7 +68,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12" # pinned to match the committed bun.lock
 
       - name: Install canvas build deps
         run: sudo apt-get update && sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
@@ -103,7 +103,7 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: latest
+          bun-version: "1.3.12" # pinned to match the committed bun.lock
 
       - name: Install canvas build deps
         run: sudo apt-get update && sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev

src/app/api/chat/upload/route.ts

@@ -1,14 +1,14 @@
 import { NextResponse } from "next/server"
-import { auth } from "@/lib/auth"
+import { getRequestUserId } from "@/lib/mobile-auth"
 import { ChatUploadFormSchema } from "@/features/chat-public/schema"
 import {
   isChatPublicServiceError,
   uploadChatAttachment,
 } from "@/features/chat-public/service"
 
 export async function POST(req: Request) {
-  const session = await auth()
-  if (!session?.user?.id) {
+  const userId = await getRequestUserId(req)
+  if (!userId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
   }
 
@@ -28,7 +28,7 @@ export async function POST(req: Request) {
   const result = await uploadChatAttachment({
     file: parsedForm.data.file,
     sessionId: parsedForm.data.sessionId,
-    userId: session.user.id,
+    userId,
   })
 
   if (isChatPublicServiceError(result)) {

src/app/api/dashboard/chat/sessions/[id]/messages/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server"
 import { auth } from "@/lib/auth"
+import { getRequestUserId } from "@/lib/mobile-auth"
 import {
   DashboardChatSessionIdParamsSchema,
   DashboardChatSessionMessageDeleteBodySchema,
@@ -18,8 +19,8 @@ export async function POST(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(req)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
@@ -36,7 +37,7 @@ export async function POST(
       )
     }
     const result = await addDashboardChatSessionMessages({
-      userId: session.user.id,
+      userId,
       sessionId: parsedParams.data.id,
       input: parsedBody.data,
     })
@@ -96,8 +97,8 @@ export async function DELETE(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(req)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
@@ -114,7 +115,7 @@ export async function DELETE(
       )
     }
     const result = await deleteDashboardChatSessionMessages({
-      userId: session.user.id,
+      userId,
       sessionId: parsedParams.data.id,
       input: parsedBody.data,
     })

src/app/api/dashboard/chat/sessions/[id]/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server"
-import { auth } from "@/lib/auth"
+import { getRequestUserId } from "@/lib/mobile-auth"
 import {
   DashboardChatSessionIdParamsSchema,
   DashboardChatSessionUpdateBodySchema,
@@ -16,8 +16,8 @@ export async function GET(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(req)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
@@ -27,7 +27,7 @@ export async function GET(
     }
 
     const result = await getDashboardChatSession({
-      userId: session.user.id,
+      userId,
       sessionId: parsedParams.data.id,
     })
 
@@ -47,8 +47,8 @@ export async function PATCH(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(req)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
@@ -67,7 +67,7 @@ export async function PATCH(
       )
     }
     const result = await updateDashboardChatSession({
-      userId: session.user.id,
+      userId,
       sessionId: parsedParams.data.id,
       input: parsedBody.data,
     })
@@ -88,8 +88,8 @@ export async function DELETE(
   { params }: { params: Promise<{ id: string }> }
 ) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(req)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
@@ -99,7 +99,7 @@ export async function DELETE(
     }
 
     const result = await deleteDashboardChatSession({
-      userId: session.user.id,
+      userId,
       sessionId: parsedParams.data.id,
     })
 

src/app/api/dashboard/chat/sessions/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server"
-import { auth } from "@/lib/auth"
+import { getRequestUserId } from "@/lib/mobile-auth"
 import {
   DashboardChatSessionCreateBodySchema,
 } from "@/features/conversations/sessions/schema"
@@ -9,14 +9,14 @@ import {
 } from "@/features/conversations/sessions/service"
 import { isHttpServiceError } from "@/features/shared/http-service-error"
 
-export async function GET() {
+export async function GET(request: Request) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(request)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
-    const result = await listDashboardChatSessions({ userId: session.user.id })
+    const result = await listDashboardChatSessions({ userId })
     return NextResponse.json(result)
   } catch (error) {
     console.error("[Chat Sessions API] GET error:", error)
@@ -26,8 +26,8 @@ export async function GET() {
 
 export async function POST(req: Request) {
   try {
-    const session = await auth()
-    if (!session?.user?.id) {
+    const userId = await getRequestUserId(req)
+    if (!userId) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
@@ -43,7 +43,7 @@ export async function POST(req: Request) {
       )
     }
     const result = await createDashboardChatSession({
-      userId: session.user.id,
+      userId,
       input: parsedBody.data,
     })
 

src/app/api/mobile/admin/models/route.ts

@@ -0,0 +1,42 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import {
+  listAdminModels,
+  setModelEnabled,
+  setModelToolCalling,
+  setDefaultChatModel,
+} from "@/features/platform-admin/models-service"
+
+export async function GET(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const params = new URL(request.url).searchParams
+  const result = await listAdminModels({
+    search: params.get("search") ?? undefined,
+    providerId: params.get("providerId") ?? undefined,
+  })
+  return NextResponse.json(result)
+}
+
+export async function PATCH(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const body = await request.json().catch(() => null)
+  if (!body?.id) return NextResponse.json({ error: "id is required" }, { status: 400 })
+
+  let result: { ok?: boolean; error?: string; defaultModelId?: string }
+  if (body.default === true) {
+    result = await setDefaultChatModel(auth.user, body.id)
+  } else if (typeof body.enabled === "boolean") {
+    result = await setModelEnabled(auth.user, body.id, body.enabled)
+  } else if (typeof body.hasToolCalling === "boolean") {
+    result = await setModelToolCalling(auth.user, body.id, body.hasToolCalling)
+  } else {
+    return NextResponse.json(
+      { error: "Nothing to update (enabled, default, or hasToolCalling)" },
+      { status: 400 },
+    )
+  }
+  if (result.error) return NextResponse.json({ error: result.error }, { status: 400 })
+  return NextResponse.json(result)
+}

src/app/api/mobile/admin/models/sync/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import { syncModelsFromOpenRouter } from "@/lib/models/sync"
+
+export async function POST(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  if (!process.env.OPENROUTER_API_KEY) {
+    return NextResponse.json({ error: "OPENROUTER_API_KEY is not configured" }, { status: 400 })
+  }
+  try {
+    return NextResponse.json(await syncModelsFromOpenRouter())
+  } catch (err) {
+    return NextResponse.json(
+      { error: `Sync failed: ${err instanceof Error ? err.message : err}` },
+      { status: 502 },
+    )
+  }
+}

src/app/api/mobile/admin/providers/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import { listProviders } from "@/features/platform-admin/providers-service"
+
+export async function GET(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  return NextResponse.json({ providers: await listProviders() })
+}

src/app/api/mobile/admin/settings/kb/route.ts

@@ -0,0 +1,25 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import { getKbSettings, updateKbSettings } from "@/features/platform-admin/kb-settings-service"
+
+export async function GET(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  return NextResponse.json(await getKbSettings())
+}
+
+export async function PUT(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const body = await request.json().catch(() => null)
+  if (!body?.updates || typeof body.updates !== "object") {
+    return NextResponse.json({ error: "updates object is required" }, { status: 400 })
+  }
+  const result = await updateKbSettings(auth.user, body.updates, {
+    confirmEmbeddingChange: body.confirmEmbeddingChange === true,
+  })
+  if ("error" in result) {
+    return NextResponse.json(result, { status: result.requiresEmbeddingConfirmation ? 409 : 400 })
+  }
+  return NextResponse.json(await getKbSettings())
+}

src/app/api/mobile/admin/users/[id]/reset-password/route.ts

@@ -0,0 +1,12 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import { resetUserPassword } from "@/features/platform-admin/users-service"
+
+export async function POST(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const { id } = await params
+  const result = await resetUserPassword(auth.user, id)
+  if ("error" in result) return NextResponse.json({ error: result.error }, { status: 404 })
+  return NextResponse.json(result)
+}

src/app/api/mobile/admin/users/[id]/route.ts

@@ -0,0 +1,31 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import { getUserDetail, setUserSuspended, setUserRole } from "@/features/platform-admin/users-service"
+
+export async function GET(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const { id } = await params
+  const detail = await getUserDetail(id)
+  if (!detail) return NextResponse.json({ error: "User not found" }, { status: 404 })
+  return NextResponse.json(detail)
+}
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const { id } = await params
+  const body = await request.json().catch(() => null)
+  if (!body) return NextResponse.json({ error: "Invalid body" }, { status: 400 })
+  if (typeof body.suspended === "boolean") {
+    const result = await setUserSuspended(auth.user, id, body.suspended)
+    if ("error" in result) return NextResponse.json({ error: result.error }, { status: 400 })
+  }
+  if (body.role === "USER" || body.role === "ADMIN") {
+    const result = await setUserRole(auth.user, id, body.role)
+    if ("error" in result) return NextResponse.json({ error: result.error }, { status: 400 })
+  }
+  const detail = await getUserDetail(id)
+  if (!detail) return NextResponse.json({ error: "User not found" }, { status: 404 })
+  return NextResponse.json(detail)
+}

src/app/api/mobile/admin/users/route.ts

@@ -0,0 +1,33 @@
+import { NextResponse } from "next/server"
+import { requireMobileAdmin } from "@/lib/mobile-admin"
+import { listUsers, createUser } from "@/features/platform-admin/users-service"
+
+export async function GET(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const params = new URL(request.url).searchParams
+  const suspendedParam = params.get("suspended")
+  const result = await listUsers({
+    search: params.get("search") ?? undefined,
+    role: (params.get("role") as "USER" | "ADMIN" | null) ?? undefined,
+    suspended: suspendedParam === null ? undefined : suspendedParam === "true",
+    page: params.get("page") ? Number(params.get("page")) : undefined,
+    pageSize: params.get("pageSize") ? Number(params.get("pageSize")) : undefined,
+  })
+  return NextResponse.json(result)
+}
+
+export async function POST(request: Request) {
+  const auth = await requireMobileAdmin(request)
+  if ("error" in auth) return NextResponse.json({ error: auth.error }, { status: auth.status })
+  const body = await request.json().catch(() => null)
+  if (!body?.email) return NextResponse.json({ error: "email is required" }, { status: 400 })
+  const result = await createUser(auth.user, {
+    email: body.email,
+    name: body.name ?? "",
+    password: body.password || undefined,
+    role: body.role,
+  })
+  if ("error" in result) return NextResponse.json({ error: result.error }, { status: 400 })
+  return NextResponse.json(result, { status: 201 })
+}