/**
 * GET /_emdash/api/admin/authz/catalog
 *
 * Everything the policy editor and the Routes tab need in one call: the
 * generated route catalogue, the admin page catalogue, and the permission
 * table with each key's legacy minimum level.
 */

import { ADMIN_PAGES, Permissions } from "@premium-cms/auth";
import type { APIRoute } from "astro";

import { requirePerm } from "#api/authorize.js";
import { apiSuccess } from "#api/error.js";
import { catalogGroups, patternToGrantPath, pluginCatalogEntries, ROUTE_CATALOG } from "#auth/route-catalog.js";

export const prerender = false;

export const GET: APIRoute = async ({ locals }) => {
	const { user, emdash } = locals;
	const denied = requirePerm(user, "routes:read");
	if (denied) return denied;

	const pluginEntries = pluginCatalogEntries(emdash?.listPluginRoutes?.() ?? []);
	return apiSuccess({
		routes: [...ROUTE_CATALOG, ...pluginEntries].map((e) => ({
			...e,
			grantPath: patternToGrantPath(e.pattern),
		})),
		groups: catalogGroups(pluginEntries),
		adminPages: ADMIN_PAGES,
		permissions: Object.entries(Permissions).map(([key, minLevel]) => ({ key, minLevel })),
	});
};

// Static data; a long private cache is fine, and the auth middleware already
// marks every /_emdash response no-store for shared caches.