configurable default homepage

src/routes/api/settings/navigation/+server.ts

@@ -0,0 +1,49 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from '@sveltejs/kit';
+import {
+	getGlobalNavPreferences, setGlobalNavPreferences,
+	getUserNavPreferences, setUserNavPreferences,
+	getEffectiveNavPreferences,
+	parseNavPatch,
+	type NavPreferences
+} from '$lib/server/nav-preferences';
+import { validateSession, isAuthEnabled } from '$lib/server/auth';
+import { authorize } from '$lib/server/authorize';
+
+// GET /api/settings/navigation — returns effective prefs (for redirect/env-click), plus the raw
+// global + per-user values so the UI can show what's inherited. Auth off => global only.
+export const GET: RequestHandler = async ({ cookies }) => {
+	const authEnabled = await isAuthEnabled();
+	const user = authEnabled ? await validateSession(cookies) : null;
+	const global = await getGlobalNavPreferences();
+	const userPrefs = user ? await getUserNavPreferences(user.id) : null;
+	const effective = await getEffectiveNavPreferences(user?.id ?? null);
+	return json({ effective, global, user: userPrefs });
+};
+
+// PUT /api/settings/navigation?scope=global|user
+export const PUT: RequestHandler = async ({ request, url, cookies }) => {
+	const scope = url.searchParams.get('scope') ?? 'global';
+	let patch: Partial<NavPreferences>;
+	try {
+		patch = parseNavPatch(await request.json());
+	} catch (e) {
+		return json({ error: e instanceof Error ? e.message : 'Invalid request' }, { status: 400 });
+	}
+
+	if (scope === 'user') {
+		if (!(await isAuthEnabled())) return json({ error: 'Authentication is not enabled' }, { status: 400 });
+		const user = await validateSession(cookies);
+		if (!user) return json({ error: 'Not authenticated' }, { status: 401 });
+		await setUserNavPreferences(user.id, patch);
+		return json({ success: true, user: await getUserNavPreferences(user.id) });
+	}
+
+	// global scope — needs settings-edit permission (mirrors /api/settings/general POST)
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !(await auth.can('settings', 'edit'))) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+	await setGlobalNavPreferences(patch);
+	return json({ success: true, global: await getGlobalNavPreferences() });
+};