merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/src/routes/settings.ts

@@ -3,24 +3,32 @@
  */
 import type { FastifyInstance } from 'fastify';
 import type { DatabaseInterface } from '../database/DatabaseInterface.js';
+import { requireAuth } from '../auth/authMiddleware.js';
+import type { AuthService } from '../auth/AuthService.js';
+import { validateSettingsKey, validateSettingsValue } from '../utils/validation.js';
 
-export function registerSettingsRoutes(fastify: FastifyInstance, db: DatabaseInterface) {
+export function registerSettingsRoutes(fastify: FastifyInstance, db: DatabaseInterface, authService: AuthService) {
   // Get a single setting by key
   fastify.get('/api/settings/:key', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { key } = request.params as { key: string };
+    const keyErr = validateSettingsKey(key);
+    if (keyErr) return reply.code(400).send({ error: keyErr });
     const setting = db.getSetting(key);
     if (!setting) return reply.code(404).send({ error: 'Setting not found' });
     return setting;
   });
 
   // Create or update a setting (upsert)
-  fastify.put('/api/settings/:key', async (request) => {
+  fastify.put('/api/settings/:key', async (request, reply) => {
+    if (!requireAuth(request, reply, authService)) return;
     const { key } = request.params as { key: string };
+    const keyErr = validateSettingsKey(key);
+    if (keyErr) return reply.code(400).send({ error: keyErr });
     const body = request.body as { value?: string };
-    if (body.value === undefined) {
-      return { error: 'Value is required' };
-    }
-    db.setSetting(key, body.value);
-    return { key, value: body.value, updated_at: new Date().toISOString() };
+    const valueErr = validateSettingsValue(body.value);
+    if (valueErr) return reply.code(400).send({ error: valueErr });
+    db.setSetting(key, body.value as string);
+    return { key, value: body.value as string, updated_at: new Date().toISOString() };
   });
 }