/**
 * Single API token endpoint
 *
 * DELETE /_emdash/api/admin/api-tokens/:id — Revoke a token
 *
 * Like creation, revocation is refused when the caller is authenticated by
 * a token: a compromised token must not be able to revoke its siblings.
 */

import type { APIRoute } from "astro";

import { requirePerm } from "#api/authorize.js";
import { apiError, handleError, unwrapResult } from "#api/error.js";
import { handleApiTokenRevoke } from "#api/handlers/api-tokens.js";

export const prerender = false;

export const DELETE: APIRoute = async ({ params, locals }) => {
	const { emdash, user } = locals;

	if (!emdash?.db) {
		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
	}

	if (locals.tokenAuth) {
		return apiError(
			"TOKEN_AUTH_FORBIDDEN",
			"API tokens cannot be created or revoked using an API token. Sign in to the admin to manage tokens.",
			403,
		);
	}

	const denied = requirePerm(user, "api_tokens:manage");
	if (denied) return denied;

	const tokenId = params.id;
	if (!tokenId) {
		return apiError("VALIDATION_ERROR", "Token ID is required", 400);
	}

	try {
		const result = await handleApiTokenRevoke(emdash.db, tokenId, user!.id);
		return unwrapResult(result);
	} catch (error) {
		return handleError(error, "Failed to revoke API token", "TOKEN_REVOKE_ERROR");
	}
};