import { f as defineAdminEventHandler, a5 as isMfaEnabledGlobally, c as createError, q as readBody, ak as verifyMfaChallenge, W as requireAdminAuth, ag as findAdminUserById, a6 as getAdminMfaState, aq as generateTotpSecret, ar as setMfaPendingSecret, as as config, at as buildOtpauthUri, ad as logAuditEventAsync, t as getAdminActor, au as TOTP_STEP_SECONDS, av as TOTP_DIGITS, aw as TOTP_ALGORITHM } from '../../../../../nitro/nitro.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';

const setup_post = defineAdminEventHandler("admin:auth:mfa:setup", async (event) => {
  if (!isMfaEnabledGlobally()) {
    throw createError({
      statusCode: 403,
      statusMessage: "Forbidden",
      message: "MFA is disabled by site configuration"
    });
  }
  const body = await readBody(event);
  const challengeToken = body == null ? void 0 : body.challengeToken;
  let viaChallenge = false;
  let adminUserId;
  if (challengeToken) {
    const challenge = verifyMfaChallenge(challengeToken);
    if (!challenge) {
      throw createError({
        statusCode: 401,
        statusMessage: "Unauthorized",
        message: "Challenge token is invalid or expired"
      });
    }
    if (challenge.purpose !== "enroll") {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "Challenge is not for enrollment"
      });
    }
    adminUserId = challenge.sub;
    viaChallenge = true;
  } else {
    await requireAdminAuth(event);
    const ctxUser = event.context.adminUser;
    if (!ctxUser) {
      throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
    }
    adminUserId = ctxUser.id;
  }
  const adminUser = await findAdminUserById(adminUserId);
  if (!adminUser) {
    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
  }
  const existing = await getAdminMfaState(adminUser.id);
  if (existing == null ? void 0 : existing.enabled) {
    throw createError({
      statusCode: 409,
      statusMessage: "Conflict",
      message: "MFA is already enabled. Disable it first to re-enroll."
    });
  }
  const secret = generateTotpSecret();
  await setMfaPendingSecret(adminUser.id, secret);
  const issuer = String(config.get("site.name", "Notty CMS"));
  const otpauthUri = buildOtpauthUri({
    secret,
    account: adminUser.email,
    issuer
  });
  logAuditEventAsync({
    action: "mfa.enrollment_started",
    actor: viaChallenge ? {
      type: "admin",
      id: adminUser.id,
      displayName: adminUser.username,
      email: adminUser.email,
      role: adminUser.role
    } : getAdminActor(event),
    target: { entityType: "admin_user", entityId: adminUser.id, displayName: adminUser.username },
    outcome: "success"
  });
  return {
    success: true,
    data: {
      secret,
      otpauthUri,
      issuer,
      account: adminUser.email,
      algorithm: TOTP_ALGORITHM,
      digits: TOTP_DIGITS,
      period: TOTP_STEP_SECONDS
    }
  };
});

export { setup_post as default };
//# sourceMappingURL=setup.post.mjs.map
