// server/api/admin/system-config.get.ts - 读取系统配置（仅 superadmin 可访问）
//
// 流程：鉴权 → 二次校验 superadmin → 读 system_config 表 → 遮蔽 key → 返回
// 安全边界：
// - handler 内独立校验 role === 'superadmin'，不依赖 middleware
// - API Key 只返回遮蔽预览（前4...后4），不返回明文
// - 此接口不返回任何用户数据

import { setResponseStatus } from "h3";

import { apiErr, apiOk } from "~~/server/utils/response";
import { getSysConfig, maskApiKey } from "~~/server/utils/sysConfig";
import type { ISystemConfigResponse } from "~~/shared/types/settings";

export default defineEventHandler(
  async (event): Promise<ISystemConfigResponse> => {
    // 二次校验：必须是 superadmin 才能访问系统配置
    const role = (event.context.auth?.user as { role?: string } | undefined)
      ?.role;
    if (role !== "superadmin") {
      setResponseStatus(event, 403);
      return apiErr(403, "权限不足") as unknown as ISystemConfigResponse;
    }

    const cfg = await getSysConfig();

    return apiOk({
      openAiApiBase: cfg.openAiApiBase,
      openAiApiKeyPreview: maskApiKey(cfg.openAiApiKey),
      openAiModel: cfg.openAiModel,
      maxTokens: cfg.maxTokens,
      temperature: cfg.temperature,
      maxSseLineBytes: cfg.maxSseLineBytes,
      allowRegistration: cfg.allowRegistration
    });
  }
);