Function PATCH

web/src/app/api/user/preferences/route.ts:18–85

(request: NextRequest)

})

export async function PATCH(request: NextRequest) {
  let userId: string | undefined

  // First, try Bearer token authentication (for CLI clients)
  const apiKey = extractApiKeyFromHeader(request)
  if (apiKey) {
    const userIdFromToken = await getUserIdFromSessionToken(apiKey)
    if (userIdFromToken) {
      userId = userIdFromToken
    }
  }

  // Fall back to NextAuth session authentication (for web clients)
  if (!userId) {
    const session = await getServerSession(authOptions)
    userId = session?.user?.id
  }

  if (!userId) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  let body: unknown
  try {
    body = await request.json()
  } catch {
    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
  }

  const parsed = updatePreferencesSchema.safeParse(body)

  if (!parsed.success) {
    return NextResponse.json(
      { error: 'Invalid request body', details: parsed.error.flatten() },
      { status: 400 },
    )
  }

  const { fallbackToALaCarte } = parsed.data

  // Build the update object with only provided fields
  const updates: Partial<{ fallback_to_a_la_carte: boolean }> = {}

  if (fallbackToALaCarte !== undefined) {
    updates.fallback_to_a_la_carte = fallbackToALaCarte
  }

  if (Object.keys(updates).length === 0) {
    return NextResponse.json({ error: 'No updates provided' }, { status: 400 })
  }

  try {
    await db
      .update(schema.user)
      .set(updates)
      .where(eq(schema.user.id, userId))

    logger.info({ userId, updates }, 'User preferences updated')