import { eq } from 'drizzle-orm';
import { twoFactors, users } from '~~/drizzle/schema';
import { db } from '~~/server/lib/db';
import { lockAccount, revokeTwoFactorTrust } from "~~/server/lib/account-security";

/**
 * Turns two-factor sign-in off for a user who lost their authenticator app
 * and backup codes. They sign in with just their password again and can set
 * it up from scratch.
 */
export default defineEventHandler(async (event) => {
    await protectAdminRoute(event);

    const id = getRouterParam(event, 'id')!;

    const account = await db.query.users.findFirst({
        where: {
            id,
        },
    });

    if (!account) {
        throw createError({
            statusCode: 404,
            statusMessage: 'User not found',
        });
    }

    await db.transaction(async (tx) => {
        await lockAccount(tx, id);
        await revokeTwoFactorTrust(tx, id);
        await tx.delete(twoFactors).where(eq(twoFactors.userId, id));
        await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, id));
    });

    return { ok: true };
});