import { db } from '~~/server/lib/db';

/**
 * Deletes someone else's account and everything that belongs to it.
 *
 * Admins delete their own account from their profile, where it asks for the
 * password and keeps the last admin from leaving.
 */
export default defineEventHandler(async (event) => {
    await protectAdminRoute(event);

    const id = getRouterParam(event, 'id')!;

    if (id === event.context.user!.id) {
        throw createError({
            statusCode: 400,
            statusMessage: 'You cannot delete your own account here',
            data: {
                code: 'CANNOT_DELETE_YOURSELF',
            },
        });
    }

    const account = await db.query.users.findFirst({
        where: {
            id,
        },
    });

    if (!account) {
        throw createError({
            statusCode: 404,
            statusMessage: 'User not found',
        });
    }

    const deleted = await deleteAccount(id);
    if (!deleted.ok) {
        throw createError({
            statusCode: 409,
            statusMessage: "The last usable admin cannot be deleted",
            data: { code: deleted.error },
        });
    }

    return { ok: true };
});