webmail/app/api/admin/policy/route.ts

import { NextRequest, NextResponse } from 'next/server';
import { configManager } from '@/lib/admin/config-manager';
import { requireAdminAuth, getClientIP } from '@/lib/admin/session';
import { auditLog } from '@/lib/admin/audit';
import { logger } from '@/lib/logger';
import { POLICY_DOMAINS_HEADER, POLICY_SCOPE_HEADER, type SettingsPolicy } from '@/lib/admin/types';
import { canSeeInstanceDetails, signedInIdentity } from '@/lib/auth/instance-details';
import { bearerIdentity } from '@/lib/auth/bearer-identity';
import { scopesVisibleTo } from '@/lib/admin/policy-scopes';
import { configReadOnlyResponse } from '@/lib/admin/config-read-only-response';

/**
 * GET /api/admin/policy - Get settings policy (NOT admin-protected - users read this;
 * visitors who are not signed in get the subset the login page needs)
 *
 * Clients without a webmail session (the mobile app) sign in with
 * `Authorization: Bearer <JMAP access token>` for the configured mail server
 * and get what a signed-in user of that account gets here
 * (lib/auth/bearer-identity.ts). A token that doesn't check out gets the
 * public subset, as without one.
 */
export async function GET(request: NextRequest) {
  try {
    await configManager.ensureLoaded();
    const policy = configManager.getPolicy();
    if (!(await canSeeInstanceDetails(request))) {
      const tokenIdentity = await bearerIdentity(request);
      if (tokenIdentity) return userPolicyResponse(policy, tokenIdentity.addresses);
      // The login page needs the theme policy and gates; the plugin lists,
      // push relays and sidebar app URLs map the deployment and are only
      // used after signing in, when the client fetches the policy again.
      return NextResponse.json(
        {
          ...policy,
          forceEnabledPlugins: [],
          approvedPlugins: [],
          pushRelays: [],
          pushRelayUrl: '',
          pushRelayUrlLocked: false,
          defaultSidebarApps: [],
          // Signatures, domain lists and scopes describe the organisation
          // and only apply once someone is signed in.
          organisation: undefined,
          scopes: [],
        },
        { headers: { 'Cache-Control': 'no-store', [POLICY_SCOPE_HEADER]: 'public' } },
      );
    }
    // Users get only the scopes for their own domains, so on an instance
    // shared by several organisations one doesn't see another's settings.
    // Without a session secret the server can't tell who is asking and
    // answers with all of them (documented).
    const identity = await signedInIdentity();
    if (identity !== null && !identity.admin) return userPolicyResponse(policy, identity.addresses);
    return NextResponse.json({ ...policy, scopes: policy.scopes ?? [] }, {
      headers: { 'Cache-Control': 'no-store' },
    });
  } catch (error) {
    logger.error('Policy read error', { error: error instanceof Error ? error.message : 'Unknown error' });
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
}

/** The policy for a signed-in user who is not the admin, with the addresses they sign in with. */
function userPolicyResponse(policy: SettingsPolicy, addresses: string[]): NextResponse {
  const scopes = scopesVisibleTo(policy.scopes ?? [], addresses);
  // Which domains the scopes were picked for, so a browser that signs in
  // to an account of another domain knows to fetch again.
  const domains = [...new Set(addresses.filter((a) => a.includes('@')).map((a) => a.slice(a.lastIndexOf('@') + 1)).filter(Boolean))].join(',');
  return NextResponse.json({ ...policy, scopes }, {
    headers: { 'Cache-Control': 'no-store', [POLICY_DOMAINS_HEADER]: domains },
  });
}

/**
 * PUT /api/admin/policy - Update settings policy (admin-protected)
 */
export async function PUT(request: NextRequest) {
  try {
    const result = await requireAdminAuth(request);
    if ('error' in result) return result.error;

    const ip = getClientIP(request);
    const policy = await request.json() as SettingsPolicy;

    if (!policy || typeof policy !== 'object') {
      return NextResponse.json({ error: 'Invalid policy object' }, { status: 400 });
    }

    // Basic validation
    if (policy.restrictions && typeof policy.restrictions !== 'object') {
      return NextResponse.json({ error: 'restrictions must be an object' }, { status: 400 });
    }
    if (policy.features && typeof policy.features !== 'object') {
      return NextResponse.json({ error: 'features must be an object' }, { status: 400 });
    }
    if (policy.defaults !== undefined && (typeof policy.defaults !== 'object' || policy.defaults === null || Array.isArray(policy.defaults))) {
      return NextResponse.json({ error: 'defaults must be an object' }, { status: 400 });
    }
    if (policy.themePolicy && typeof policy.themePolicy !== 'object') {
      return NextResponse.json({ error: 'themePolicy must be an object' }, { status: 400 });
    }
    if (policy.defaultSidebarApps !== undefined && !Array.isArray(policy.defaultSidebarApps)) {
      return NextResponse.json({ error: 'defaultSidebarApps must be an array' }, { status: 400 });
    }
    if (policy.scopes !== undefined && !Array.isArray(policy.scopes)) {
      return NextResponse.json({ error: 'scopes must be an array' }, { status: 400 });
    }
    if (policy.organisation !== undefined && (typeof policy.organisation !== 'object' || policy.organisation === null || Array.isArray(policy.organisation))) {
      return NextResponse.json({ error: 'organisation must be an object' }, { status: 400 });
    }

    await configManager.setPolicy(policy);
    await auditLog('policy.update', {
      restrictionCount: Object.keys(policy.restrictions || {}).length,
      // Entries the sanitizer dropped never reach users, so log what stuck.
      defaultSidebarAppCount: configManager.getPolicy().defaultSidebarApps?.length ?? 0,
    }, ip);

    return NextResponse.json({ ok: true });
  } catch (error) {
    const readOnly = configReadOnlyResponse(error);
    if (readOnly) return readOnly;
    logger.error('Policy update error', { error: error instanceof Error ? error.message : 'Unknown error' });
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
}