first commit

2026-06-06 00:49:07 +08:00
commit 2b860d201e
134 changed files with 22773 additions and 0 deletions
@@ -0,0 +1,64 @@
+import { auth } from "@/lib/auth";
+import { updateAdminAppUserStatus } from "@/server/admin/app-users";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const updateUserSchema = z.object({
+    status: z.enum(["active", "disabled"]),
+});
+
+async function requireAdminSession() {
+    const session = await auth();
+
+    if (!session) {
+        return null;
+    }
+
+    return session;
+}
+
+export async function PATCH(
+    request: Request,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = updateUserSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const { id } = await params;
+        const data = await updateAdminAppUserStatus({
+            userId: id,
+            status: parsed.data.status,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,137 @@
+import { auth } from "@/lib/auth";
+import { createSupabaseServiceRoleClient } from "@/lib/supabase/service-role";
+import { updateGalleryPhotoPickStatus } from "@/server/admin/gallery-pick";
+import { NextResponse, type NextRequest } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const galleryPhotoSelect =
+    "id,unsplash_id,slug,description,alt_description,width,height,color,color_family,likes,urls,user_info,photo_created_at,is_picked,picked_at,picked_by,oss_url,oss_object_key,oss_synced_at,oss_sync_error";
+
+const patchSchema = z.object({
+    unsplashId: z.string().min(1),
+    isPicked: z.boolean(),
+});
+
+async function requireAdminSession() {
+    const session = await auth();
+
+    if (!session) {
+        return null;
+    }
+
+    return session;
+}
+
+export async function GET(request: NextRequest) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const { searchParams } = new URL(request.url);
+        const page = parseInt(searchParams.get("page") || "1", 10);
+        const perPage = parseInt(searchParams.get("per_page") || "24", 10);
+        const picked = searchParams.get("picked");
+        const colorFamily = searchParams.get("color_family");
+
+        if (page < 1 || perPage < 1 || perPage > 100) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid pagination parameters." },
+                { status: 400 },
+            );
+        }
+
+        const supabase = createSupabaseServiceRoleClient();
+
+        let query = supabase
+            .from("wg_gallery_photos")
+            .select(galleryPhotoSelect, { count: "exact" });
+
+        if (picked === "true") {
+            query = query.eq("is_picked", true);
+        } else if (picked === "false") {
+            query = query.eq("is_picked", false);
+        }
+
+        if (colorFamily && colorFamily !== "all") {
+            query = query.eq("color_family", colorFamily);
+        }
+
+        const { data, error, count } = await query
+            .order("picked_at", { ascending: false, nullsFirst: false })
+            .order("photo_created_at", { ascending: false })
+            .range((page - 1) * perPage, page * perPage - 1);
+
+        if (error) {
+            throw error;
+        }
+
+        return NextResponse.json({
+            ok: true,
+            data: data ?? [],
+            pagination: {
+                page,
+                perPage,
+                total: count ?? 0,
+                hasMore: (count ?? 0) > page * perPage,
+            },
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        console.error("[api/admin/gallery-photos] PATCH failed", error);
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function PATCH(request: NextRequest) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = patchSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const data = await updateGalleryPhotoPickStatus({
+            isPicked: parsed.data.isPicked,
+            pickedBy:
+                session.user?.email ?? session.user?.id ?? "wallora-admin",
+            unsplashId: parsed.data.unsplashId,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,138 @@
+import { auth } from "@/lib/auth";
+import {
+    deletePhotoCollection,
+    getAdminPhotoCollection,
+    updatePhotoCollection,
+} from "@/server/admin/photo-collections";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const collectionInputSchema = z.object({
+    title: z.string().min(1),
+    slug: z.string().optional().nullable(),
+    description: z.string().optional().nullable(),
+    coverPhotoId: z.string().uuid().optional().nullable(),
+    isPublished: z.boolean().default(false),
+    photoIds: z.array(z.string().uuid()).default([]),
+});
+
+async function requireAdminSession() {
+    const session = await auth();
+
+    if (!session) {
+        return null;
+    }
+
+    return session;
+}
+
+export async function GET(
+    _request: Request,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const { id } = await params;
+        const data = await getAdminPhotoCollection(id);
+
+        if (!data) {
+            return NextResponse.json(
+                { ok: false, error: "Collection was not found." },
+                { status: 404 },
+            );
+        }
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function PATCH(
+    request: Request,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = collectionInputSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const { id } = await params;
+        const data = await updatePhotoCollection(id, parsed.data);
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function DELETE(
+    _request: Request,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const { id } = await params;
+        await deletePhotoCollection(id);
+
+        return NextResponse.json({
+            ok: true,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,92 @@
+import { auth } from "@/lib/auth";
+import {
+    createPhotoCollection,
+    listAdminPhotoCollections,
+} from "@/server/admin/photo-collections";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const collectionInputSchema = z.object({
+    title: z.string().min(1),
+    slug: z.string().optional().nullable(),
+    description: z.string().optional().nullable(),
+    coverPhotoId: z.string().uuid().optional().nullable(),
+    isPublished: z.boolean().default(false),
+    photoIds: z.array(z.string().uuid()).default([]),
+});
+
+async function requireAdminSession() {
+    const session = await auth();
+
+    if (!session) {
+        return null;
+    }
+
+    return session;
+}
+
+export async function GET() {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const data = await listAdminPhotoCollections();
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function POST(request: Request) {
+    try {
+        const session = await requireAdminSession();
+
+        if (!session) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = collectionInputSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const data = await createPhotoCollection(parsed.data);
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,3 @@
+import { GET, POST } from "@/lib/auth";
+
+export { GET, POST };
@@ -0,0 +1,52 @@
+import { syncUnsplashWallpapersToGallery } from "@/server/admin/gallery-sync";
+import { NextResponse, type NextRequest } from "next/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+function isAuthorized(request: NextRequest) {
+    const cronSecret = process.env.CRON_SECRET;
+
+    if (!cronSecret) {
+        return false;
+    }
+
+    return request.headers.get("authorization") === `Bearer ${cronSecret}`;
+}
+
+async function handleGalleryPhotosCron(request: NextRequest) {
+    if (!process.env.CRON_SECRET) {
+        return NextResponse.json(
+            { ok: false, error: "CRON_SECRET is not configured." },
+            { status: 500 },
+        );
+    }
+
+    if (!isAuthorized(request)) {
+        return NextResponse.json(
+            { ok: false, error: "Unauthorized." },
+            { status: 401 },
+        );
+    }
+
+    try {
+        const result = await syncUnsplashWallpapersToGallery();
+        return NextResponse.json({ ok: true, result });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown cron error.";
+
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function GET(request: NextRequest) {
+    return handleGalleryPhotosCron(request);
+}
+
+export async function POST(request: NextRequest) {
+    return handleGalleryPhotosCron(request);
+}
@@ -0,0 +1,44 @@
+import {
+    getAppUserLoginContextFromRequest,
+    loginAppUser,
+} from "@/server/app/app-auth";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const loginSchema = z.object({
+    email: z.email(),
+    password: z.string().min(1),
+});
+
+export async function POST(request: Request) {
+    try {
+        const parsed = loginSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const data = await loginAppUser({
+            ...parsed.data,
+            context: getAppUserLoginContextFromRequest(request),
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 401 },
+        );
+    }
+}
@@ -0,0 +1,39 @@
+import { registerAppUser } from "@/server/app/app-auth";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const registerSchema = z.object({
+    email: z.email(),
+    password: z.string().min(8),
+    displayName: z.string().optional().nullable(),
+});
+
+export async function POST(request: Request) {
+    try {
+        const parsed = registerSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const data = await registerAppUser(parsed.data);
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 400 },
+        );
+    }
+}
@@ -0,0 +1,67 @@
+import { getOptionalAppUserFromRequest } from "@/server/app/app-auth";
+import { getPublishedCollectionBySlug } from "@/server/site/photo-collections";
+import { NextResponse, type NextRequest } from "next/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(
+    request: NextRequest,
+    { params }: { params: Promise<{ slug: string }> },
+) {
+    try {
+        const { searchParams } = new URL(request.url);
+        const { slug } = await params;
+        const page = parseInt(searchParams.get("page") || "1", 10);
+        const pageSize = parseInt(
+            searchParams.get("pageSize") ||
+                searchParams.get("page_size") ||
+                "24",
+            10,
+        );
+
+        if (page < 1 || pageSize < 1 || pageSize > 100) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid pagination parameters." },
+                { status: 400 },
+            );
+        }
+
+        const user = await getOptionalAppUserFromRequest(request);
+        const result = await getPublishedCollectionBySlug({
+            slug,
+            page,
+            pageSize,
+            userId: user?.id ?? null,
+        });
+
+        if (!result) {
+            return NextResponse.json(
+                { ok: false, error: "Collection was not found." },
+                { status: 404 },
+            );
+        }
+
+        return NextResponse.json({
+            ok: true,
+            data: {
+                collection: result.collection,
+                photos: result.photos,
+            },
+            pagination: {
+                page,
+                pageSize,
+                total: result.total,
+                hasMore: result.total > page * pageSize,
+                nextPage: result.total > page * pageSize ? page + 1 : null,
+            },
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,52 @@
+import { getOptionalAppUserFromRequest } from "@/server/app/app-auth";
+import { listPublishedCollections } from "@/server/site/photo-collections";
+import { NextResponse, type NextRequest } from "next/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(request: NextRequest) {
+    try {
+        const { searchParams } = new URL(request.url);
+        const page = parseInt(searchParams.get("page") || "1", 10);
+        const pageSize = parseInt(
+            searchParams.get("pageSize") ||
+                searchParams.get("page_size") ||
+                "20",
+            10,
+        );
+
+        if (page < 1 || pageSize < 1 || pageSize > 50) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid pagination parameters." },
+                { status: 400 },
+            );
+        }
+
+        const user = await getOptionalAppUserFromRequest(request);
+        const result = await listPublishedCollections({
+            page,
+            pageSize,
+            userId: user?.id ?? null,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data: result.data,
+            pagination: {
+                page,
+                pageSize,
+                total: result.total,
+                hasMore: result.total > page * pageSize,
+                nextPage: result.total > page * pageSize ? page + 1 : null,
+            },
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,142 @@
+import {
+    getAppUserFromRequest,
+    getOptionalAppUserFromRequest,
+} from "@/server/app/app-auth";
+import {
+    addUserFavorite,
+    removeUserFavorite,
+} from "@/server/app/user-favorites";
+import { getPickedGalleryPhotoById } from "@/server/site/gallery-photos";
+import { NextResponse, type NextRequest } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const paramsSchema = z.object({
+    id: z.uuid(),
+});
+
+export async function GET(
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const parsed = paramsSchema.safeParse(await params);
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid photo id." },
+                { status: 400 },
+            );
+        }
+
+        const user = await getOptionalAppUserFromRequest(request);
+        const data = await getPickedGalleryPhotoById({
+            id: parsed.data.id,
+            userId: user?.id ?? null,
+        });
+
+        if (!data) {
+            return NextResponse.json(
+                { ok: false, error: "Photo was not found." },
+                { status: 404 },
+            );
+        }
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function POST(
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = paramsSchema.safeParse(await params);
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid photo id." },
+                { status: 400 },
+            );
+        }
+
+        const data = await addUserFavorite({
+            userId: user.id,
+            photoId: parsed.data.id,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function DELETE(
+    request: NextRequest,
+    { params }: { params: Promise<{ id: string }> },
+) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = paramsSchema.safeParse(await params);
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid photo id." },
+                { status: 400 },
+            );
+        }
+
+        await removeUserFavorite({
+            userId: user.id,
+            photoId: parsed.data.id,
+        });
+
+        return NextResponse.json({
+            ok: true,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,54 @@
+import { getOptionalAppUserFromRequest } from "@/server/app/app-auth";
+import { listPickedGalleryPhotos } from "@/server/site/gallery-photos";
+import { NextResponse, type NextRequest } from "next/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(request: NextRequest) {
+    try {
+        const { searchParams } = new URL(request.url);
+        const page = parseInt(searchParams.get("page") || "1", 10);
+        const pageSize = parseInt(
+            searchParams.get("pageSize") ||
+                searchParams.get("page_size") ||
+                "24",
+            10,
+        );
+        const colorFamily = searchParams.get("colorFamily");
+
+        if (page < 1 || pageSize < 1 || pageSize > 100) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid pagination parameters." },
+                { status: 400 },
+            );
+        }
+
+        const user = await getOptionalAppUserFromRequest(request);
+        const result = await listPickedGalleryPhotos({
+            colorFamily,
+            page,
+            pageSize,
+            userId: user?.id ?? null,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data: result.data,
+            pagination: {
+                page,
+                pageSize,
+                total: result.total,
+                hasMore: result.total > page * pageSize,
+                nextPage: result.total > page * pageSize ? page + 1 : null,
+            },
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,52 @@
+import { getAppUserFromRequest } from "@/server/app/app-auth";
+import { removeUserFavorite } from "@/server/app/user-favorites";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const paramsSchema = z.object({
+    photoId: z.uuid(),
+});
+
+export async function DELETE(
+    request: Request,
+    { params }: { params: Promise<{ photoId: string }> },
+) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = paramsSchema.safeParse(await params);
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid photo id." },
+                { status: 400 },
+            );
+        }
+
+        await removeUserFavorite({
+            userId: user.id,
+            photoId: parsed.data.photoId,
+        });
+
+        return NextResponse.json({
+            ok: true,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,107 @@
+import { getAppUserFromRequest } from "@/server/app/app-auth";
+import {
+    addUserFavorite,
+    listUserFavorites,
+} from "@/server/app/user-favorites";
+import { NextResponse, type NextRequest } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const favoriteSchema = z.object({
+    photoId: z.uuid(),
+});
+
+export async function GET(request: NextRequest) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const { searchParams } = new URL(request.url);
+        const page = parseInt(searchParams.get("page") || "1", 10);
+        const pageSize = parseInt(
+            searchParams.get("pageSize") ||
+                searchParams.get("page_size") ||
+                "24",
+            10,
+        );
+
+        if (page < 1 || pageSize < 1 || pageSize > 100) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid pagination parameters." },
+                { status: 400 },
+            );
+        }
+
+        const result = await listUserFavorites({
+            userId: user.id,
+            page,
+            pageSize,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data: result.data,
+            pagination: {
+                page,
+                pageSize,
+                total: result.total,
+                hasMore: result.total > page * pageSize,
+                nextPage: result.total > page * pageSize ? page + 1 : null,
+            },
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function POST(request: Request) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = favoriteSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const data = await addUserFavorite({
+            userId: user.id,
+            photoId: parsed.data.photoId,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data,
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
@@ -0,0 +1,32 @@
+import { getAppUserFromRequest } from "@/server/app/app-auth";
+import { NextResponse } from "next/server";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+export async function GET(request: Request) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        return NextResponse.json({
+            ok: true,
+            data: {
+                user,
+            },
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 401 },
+        );
+    }
+}
@@ -0,0 +1,90 @@
+import { getAppUserFromRequest } from "@/server/app/app-auth";
+import {
+    getUserSettings,
+    updateUserSettings,
+} from "@/server/app/user-preferences";
+import { NextResponse } from "next/server";
+import { z } from "zod";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const settingsSchema = z.object({
+    preferences: z.record(z.string(), z.unknown()).optional(),
+    downloadPreferences: z.record(z.string(), z.unknown()).optional(),
+});
+
+function mapSettings(settings: Awaited<ReturnType<typeof getUserSettings>>) {
+    return {
+        preferences: settings.preferences,
+        downloadPreferences: settings.download_preferences,
+        updatedAt: settings.updated_at,
+    };
+}
+
+export async function GET(request: Request) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const settings = await getUserSettings(user.id);
+
+        return NextResponse.json({
+            ok: true,
+            data: mapSettings(settings),
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}
+
+export async function PATCH(request: Request) {
+    try {
+        const user = await getAppUserFromRequest(request);
+
+        if (!user) {
+            return NextResponse.json(
+                { ok: false, error: "Unauthorized." },
+                { status: 401 },
+            );
+        }
+
+        const parsed = settingsSchema.safeParse(await request.json());
+
+        if (!parsed.success) {
+            return NextResponse.json(
+                { ok: false, error: "Invalid request body." },
+                { status: 400 },
+            );
+        }
+
+        const settings = await updateUserSettings({
+            userId: user.id,
+            preferences: parsed.data.preferences,
+            downloadPreferences: parsed.data.downloadPreferences,
+        });
+
+        return NextResponse.json({
+            ok: true,
+            data: mapSettings(settings),
+        });
+    } catch (error) {
+        const message =
+            error instanceof Error ? error.message : "Unknown error.";
+        return NextResponse.json(
+            { ok: false, error: message },
+            { status: 500 },
+        );
+    }
+}