import * as z from 'zod';
import { db } from '~~/server/lib/db';

/**
 * Makes a one-time link the user can set a new password with, or their first
 * one if the account was created by an admin and never had a password. The link is
 * only returned here, afterwards nobody can read it back, admins included.
 */
export default defineEventHandler(async (event) => {
    await protectAdminRoute(event);

    const result = await readValidatedBody(event, (body) =>
        z
            .object({
                // also turn two-factor off and sign every device out
                resetSecurity: z.boolean(),
            })
            .safeParse(body),
    );

    if (!result.success) {
        throw createError({
            statusCode: 400,
            message: result.error.issues[0]!.message,
        });
    }

    const id = getRouterParam(event, 'id')!;

    const account = await db.query.users.findFirst({
        where: {
            id,
        },
    });

    if (!account) {
        throw createError({
            statusCode: 404,
            statusMessage: 'User not found',
        });
    }

    return await createRecoveryLink(id, result.data.resetSecurity);
});