Spotify-Links, Live-Status-Feature (grüner Punkt) mit Owner-Toggle

cloudflare-worker/src/worker.js

@@ -24,6 +24,8 @@
      POST /admin/roles/list   { ownerCode }                -> Helfer-Codes auflisten (nur Owner)
      POST /admin/roles/create { ownerCode, role, label }    -> neuen Helfer-Code erzeugen (nur Owner)
      POST /admin/roles/revoke { ownerCode, keyId }           -> Helfer-Code entziehen (nur Owner)
+     GET  /live-status                                        -> öffentlich: {live, updatedAt}
+     POST /live-status/set  { ownerCode, live }                -> Live-Status umschalten (nur Owner)
      GET  /health           -> einfacher Check ob der Worker läuft
 
    Secrets/Bindings (siehe wrangler.toml + README.md):
@@ -33,6 +35,7 @@
 
 const ALLOWED_TYPES = ["creator", "scout", "kooperation"];
 const ROLE_KEY_PREFIX = "role:";
+const LIVE_STATUS_KEY = "meta:live";
 
 function corsHeaders() {
   // TODO: sobald die Domain final steht, statt "*" die echte Domain eintragen
@@ -40,7 +43,7 @@ function corsHeaders() {
   // an die API senden kann.
   return {
     "Access-Control-Allow-Origin": "*",
-    "Access-Control-Allow-Methods": "POST, OPTIONS",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type",
   };
 }
@@ -215,6 +218,30 @@ async function handleRolesRevoke(request, env) {
   return json({ ok: true });
 }
 
+async function handleLiveStatusGet(env) {
+  const raw = await env.BEWERBUNGEN.get(LIVE_STATUS_KEY);
+  const data = raw ? JSON.parse(raw) : { live: false, updatedAt: null };
+  return json({ ok: true, ...data });
+}
+
+async function handleLiveStatusSet(request, env) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return json({ ok: false, error: "Ungültiges JSON." }, 400);
+  }
+  if (!(await requireOwner(body, env))) {
+    return json({ ok: false, error: "Nur Dogi darf den Live-Status ändern." }, 401);
+  }
+
+  const live = !!(body && body.live);
+  const record = { live, updatedAt: new Date().toISOString() };
+  await env.BEWERBUNGEN.put(LIVE_STATUS_KEY, JSON.stringify(record));
+
+  return json({ ok: true, ...record });
+}
+
 export default {
   async fetch(request, env) {
     const url = new URL(request.url);
@@ -247,6 +274,14 @@ export default {
       return handleRolesRevoke(request, env);
     }
 
+    if (url.pathname === "/live-status" && request.method === "GET") {
+      return handleLiveStatusGet(env);
+    }
+
+    if (url.pathname === "/live-status/set" && request.method === "POST") {
+      return handleLiveStatusSet(request, env);
+    }
+
     return json({ ok: false, error: "Not found." }, 404);
   },
 };