freezmo/lib/settings.ts

"use client";

/**
 * Browser-side settings, including the user's own Ollama API key.
 *
 * The key lives ONLY here, in this browser's localStorage. It is never sent
 * anywhere except to Freezmo's own API routes on this server (in the
 * `x-ollama-key` header), which forward it to Ollama for that single request
 * and never write it to disk, a log, a cookie or the environment.
 */

const STORAGE_KEY = "freezmo.settings.v1";

/** Header that carries the browser's key to Freezmo's own API routes. */
export const API_KEY_HEADER = "x-ollama-key";

export type BrowserSettings = {
  /**
   * The user's own Ollama API key. Nothing else is stored here — the endpoint
   * and model names always come from the server's .env, never from the client.
   */
  apiKey: string;
  /** Best-effort haptics on supported devices (phones). On by default. */
  haptics: boolean;
};

const EMPTY: BrowserSettings = { apiKey: "", haptics: true };

let cached: BrowserSettings | null = null;
const listeners = new Set<() => void>();

function read(): BrowserSettings {
  if (typeof window === "undefined") return EMPTY;
  try {
    const raw = window.localStorage.getItem(STORAGE_KEY);
    if (!raw) return EMPTY;
    const parsed = JSON.parse(raw) as Partial<BrowserSettings>;
    return {
      apiKey: typeof parsed.apiKey === "string" ? parsed.apiKey.slice(0, 512) : "",
      haptics: parsed.haptics !== false,
    };
  } catch {
    return EMPTY;
  }
}

function write(next: BrowserSettings): void {
  cached = next;
  try {
    if (next.apiKey || next.haptics === false) {
      window.localStorage.setItem(STORAGE_KEY, JSON.stringify({ apiKey: next.apiKey, haptics: next.haptics }));
    } else {
      window.localStorage.removeItem(STORAGE_KEY);
    }
  } catch (error) {
    console.warn("[freezmo] could not save settings (storage disabled?)", error);
  }
  listeners.forEach((listener) => listener());
}

export const settingsStore = {
  subscribe(listener: () => void): () => void {
    if (cached === null) cached = read();
    listeners.add(listener);
    return () => listeners.delete(listener);
  },
  getSnapshot(): BrowserSettings {
    if (cached === null) cached = read();
    return cached;
  },
  getServerSnapshot(): BrowserSettings {
    return EMPTY;
  },
};

export function getApiKey(): string {
  return settingsStore.getSnapshot().apiKey;
}

/** Merge-update: callers only pass what they changed. */
export function saveSettings(next: Partial<BrowserSettings>): void {
  write({ ...settingsStore.getSnapshot(), ...next });
}

export function clearApiKey(): void {
  write({ ...settingsStore.getSnapshot(), apiKey: "" });
}

/** Header used to hand the key to our own API routes for one request. */
export function authHeaders(): Record<string, string> {
  const { apiKey } = settingsStore.getSnapshot();
  return apiKey ? { [API_KEY_HEADER]: apiKey } : {};
}