import { f as defineAdminEventHandler, W as requireAdminAuth, a5 as isMfaEnabledGlobally, c as createError, q as readBody, a6 as getAdminMfaState, ai as verifyTotp, ad as logAuditEventAsync, t as getAdminActor, al as generateRecoveryCodes, ap as updateRecoveryHashes, am as hashRecoveryCodes } from '../../../../../nitro/nitro.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';

const recoveryCodes_post = defineAdminEventHandler("admin:auth:mfa:recovery-codes", async (event) => {
  await requireAdminAuth(event);
  if (!isMfaEnabledGlobally()) {
    throw createError({
      statusCode: 403,
      statusMessage: "Forbidden",
      message: "MFA is disabled by site configuration"
    });
  }
  const ctxUser = event.context.adminUser;
  if (!ctxUser) {
    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
  }
  const body = await readBody(event);
  const code = body == null ? void 0 : body.code;
  if (!code) {
    throw createError({
      statusCode: 400,
      statusMessage: "Bad Request",
      message: "Current TOTP code is required"
    });
  }
  const state = await getAdminMfaState(ctxUser.id);
  if (!state || !state.enabled || !state.secret) {
    throw createError({
      statusCode: 400,
      statusMessage: "Bad Request",
      message: "MFA is not enabled"
    });
  }
  if (!verifyTotp(state.secret, code.trim())) {
    logAuditEventAsync({
      action: "mfa.failed",
      actor: getAdminActor(event),
      target: { entityType: "admin_user", entityId: ctxUser.id, displayName: ctxUser.username },
      outcome: "failed",
      metadata: { phase: "recovery_regenerate" }
    });
    throw createError({
      statusCode: 401,
      statusMessage: "Unauthorized",
      message: "Invalid TOTP code"
    });
  }
  const recoveryCodes = generateRecoveryCodes();
  await updateRecoveryHashes(ctxUser.id, hashRecoveryCodes(recoveryCodes));
  logAuditEventAsync({
    action: "mfa.recovery_regenerated",
    actor: getAdminActor(event),
    target: { entityType: "admin_user", entityId: ctxUser.id, displayName: ctxUser.username },
    outcome: "success"
  });
  return { success: true, data: { recoveryCodes } };
});

export { recoveryCodes_post as default };
//# sourceMappingURL=recovery-codes.post.mjs.map
