/** POST /_emdash/api/settings/frontend-token/rotate — mint a new frontend token; the old one stops working. */
import type { APIRoute } from "astro";

import { requirePerm } from "#api/authorize.js";
import { apiError, apiSuccess, handleError } from "#api/error.js";
import { rotateFrontendToken } from "../../../../../auth/frontend-account.js";

export const prerender = false;

export const POST: APIRoute = async ({ locals }) => {
	const { emdash, user } = locals;
	const denied = requirePerm(user, "settings:manage");
	if (denied) return denied;
	if (!emdash?.db) return apiError("NOT_AVAILABLE", "Database not available", 503);
	try {
		const account = await rotateFrontendToken(emdash.db);
		return apiSuccess({ token: account.token });
	} catch (error) {
		return handleError(error);
	}
};