fix(admin): persist data directory and pass env vars

app/api/admin/contact/[id]/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from "next/server";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { updateContactStatus } from "@/lib/admin/store";
+import type { InquiryStatus } from "@/lib/admin/types";
+
+const statuses: InquiryStatus[] = ["new", "in_progress", "done"];
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireAdminSession()) return NextResponse.json({ message: "Nicht autorisiert." }, { status: 401 });
+
+  const body = await request.json() as { status?: InquiryStatus };
+  if (!body.status || !statuses.includes(body.status)) {
+    return NextResponse.json({ message: "Ungültiger Status." }, { status: 400 });
+  }
+
+  const { id } = await params;
+  await updateContactStatus(id, body.status);
+  return NextResponse.json({ message: "Status aktualisiert." });
+}

app/api/admin/login/route.ts

@@ -0,0 +1,16 @@
+import { NextResponse } from "next/server";
+import { adminCookieOptions, adminSessionCookie, createAdminSession, validateAdminCredentials } from "@/lib/admin/auth";
+
+export async function POST(request: Request) {
+  const form = await request.formData();
+  const email = String(form.get("email") ?? "");
+  const password = String(form.get("password") ?? "");
+
+  if (!validateAdminCredentials(email, password)) {
+    return NextResponse.json({ message: "Ungültige Zugangsdaten." }, { status: 401 });
+  }
+
+  const response = NextResponse.json({ message: "Anmeldung erfolgreich." });
+  response.cookies.set(adminSessionCookie, createAdminSession(), adminCookieOptions());
+  return response;
+}

app/api/admin/logout/route.ts

@@ -0,0 +1,8 @@
+import { NextResponse } from "next/server";
+import { adminSessionCookie } from "@/lib/admin/auth";
+
+export async function POST() {
+  const response = NextResponse.json({ message: "Abgemeldet." });
+  response.cookies.set(adminSessionCookie, "", { path: "/", maxAge: 0 });
+  return response;
+}

app/api/admin/media/route.ts

@@ -0,0 +1,38 @@
+import { mkdir, readdir, writeFile } from "fs/promises";
+import path from "path";
+import { NextResponse } from "next/server";
+import { requireAdminSession } from "@/lib/admin/auth";
+
+const uploadDir = path.join(process.cwd(), "public", "uploads", "images");
+const allowedTypes = new Set(["image/jpeg", "image/png", "image/webp", "application/pdf"]);
+
+async function ensureUploadDir() {
+  await mkdir(uploadDir, { recursive: true });
+}
+
+export async function GET() {
+  if (!await requireAdminSession()) return NextResponse.json({ message: "Nicht autorisiert." }, { status: 401 });
+  await ensureUploadDir();
+  const files = await readdir(uploadDir);
+  return NextResponse.json({
+    files: files.map((file) => ({ name: file, url: `/uploads/images/${file}` })),
+  });
+}
+
+export async function POST(request: Request) {
+  if (!await requireAdminSession()) return NextResponse.json({ message: "Nicht autorisiert." }, { status: 401 });
+  await ensureUploadDir();
+  const form = await request.formData();
+  const file = form.get("file");
+
+  if (!(file instanceof File) || !allowedTypes.has(file.type) || file.size > 5 * 1024 * 1024) {
+    return NextResponse.json({ message: "Bitte eine JPG-, PNG-, WebP- oder PDF-Datei bis 5 MB hochladen." }, { status: 400 });
+  }
+
+  const extension = path.extname(file.name).toLowerCase();
+  const safeName = `${Date.now()}-${file.name.toLowerCase().replace(/[^a-z0-9.-]/g, "-")}`;
+  const target = safeName.endsWith(extension) ? safeName : `${safeName}${extension}`;
+  await writeFile(path.join(uploadDir, target), Buffer.from(await file.arrayBuffer()));
+
+  return NextResponse.redirect(new URL("/admin/medien?uploaded=1", request.url));
+}

app/api/admin/repair/[id]/route.ts

@@ -0,0 +1,19 @@
+import { NextResponse } from "next/server";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { updateRepairStatus } from "@/lib/admin/store";
+import type { InquiryStatus } from "@/lib/admin/types";
+
+const statuses: InquiryStatus[] = ["new", "in_progress", "done"];
+
+export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
+  if (!await requireAdminSession()) return NextResponse.json({ message: "Nicht autorisiert." }, { status: 401 });
+
+  const body = await request.json() as { status?: InquiryStatus };
+  if (!body.status || !statuses.includes(body.status)) {
+    return NextResponse.json({ message: "Ungültiger Status." }, { status: 400 });
+  }
+
+  const { id } = await params;
+  await updateRepairStatus(id, body.status);
+  return NextResponse.json({ message: "Status aktualisiert." });
+}

app/api/admin/settings/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { saveSiteSettings } from "@/lib/admin/store";
+
+export async function POST(request: Request) {
+  if (!await requireAdminSession()) return NextResponse.json({ message: "Nicht autorisiert." }, { status: 401 });
+  await saveSiteSettings(await request.formData());
+  return NextResponse.redirect(new URL("/admin/einstellungen?saved=1", request.url));
+}

app/api/admin/smtp/route.ts

@@ -0,0 +1,9 @@
+import { NextResponse } from "next/server";
+import { requireAdminSession } from "@/lib/admin/auth";
+import { saveSmtpSettings } from "@/lib/admin/store";
+
+export async function POST(request: Request) {
+  if (!await requireAdminSession()) return NextResponse.json({ message: "Nicht autorisiert." }, { status: 401 });
+  await saveSmtpSettings(await request.formData());
+  return NextResponse.redirect(new URL("/admin/smtp?saved=1", request.url));
+}

app/api/contact/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { addContactInquiry } from "@/lib/admin/store";
 
 function text(value: FormDataEntryValue | null) {
   return typeof value === "string" ? value.trim() : "";
@@ -8,16 +9,14 @@ export async function POST(request: Request) {
   const form = await request.formData();
   const name = text(form.get("name"));
   const email = text(form.get("email"));
+  const subject = text(form.get("subject"));
   const message = text(form.get("message"));
 
-  if (!name || !email.includes("@") || message.length < 10 || form.get("privacy") !== "on") {
+  if (!name || !email.includes("@") || !subject || message.length < 10 || form.get("privacy") !== "on") {
     return NextResponse.json({ message: "Bitte füllen Sie alle Pflichtfelder aus." }, { status: 400 });
   }
 
-  console.info("contact_request.received", {
-    messageLength: message.length,
-    hasEmail: true,
-  });
+  await addContactInquiry(form);
 
   return NextResponse.json({
     message: "Ihre Nachricht wurde erfasst. Sie erhalten eine Rückmeldung.",

app/api/repair/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from "next/server";
+import { addRepairInquiry } from "@/lib/admin/store";
 
 function required(value: FormDataEntryValue | null) {
   return typeof value === "string" && value.trim().length > 0;
@@ -18,18 +19,7 @@ export async function POST(request: Request) {
     return NextResponse.json({ message: "Bitte füllen Sie alle Pflichtfelder aus." }, { status: 400 });
   }
 
-  const intakeUrl = process.env.OLYMPUS_INTAKE_API_URL;
-  const hasIntegrationToken = Boolean(process.env.OLYMPUS_INTAKE_API_TOKEN);
-
-  console.info("repair_intake.received", {
-    hasIntakeIntegration: Boolean(intakeUrl && hasIntegrationToken),
-    manufacturer: String(manufacturer),
-    model: String(model),
-    deviceType: String(deviceType),
-    hasPhone: required(form.get("phone")),
-    hasSerialNumber: required(form.get("serialNumber")),
-    hasAccessories: required(form.get("accessories")),
-  });
+  await addRepairInquiry(form);
 
   return NextResponse.json({
     message: "Ihre Reparaturanfrage wurde erfasst. Sie erhalten nach Prüfung eine Rückmeldung.",