import { d as defineEventHandler, r as requireAuth, c as createError, cI as requireAdminScope, i as requireApiTokenScopes, q as readBody, f7 as createWebhook, e$ as isSsrfGuardError } from '../../nitro/nitro.mjs';
import { a as auditFromEvent } from '../../_/audit-log-helpers.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';
import '../../_/audit-log-actor.mjs';

const index_post = defineEventHandler(async (event) => {
  try {
    await requireAuth(event);
    if (!event.context.adminUser) {
      throw createError({
        statusCode: 403,
        statusMessage: "Forbidden",
        message: "Only administrators can manage webhooks"
      });
    }
    await requireAdminScope(event, "webhooks:write");
    requireApiTokenScopes(event.context.apiToken, { scopes: ["webhooks:write"] });
    const body = await readBody(event);
    if (!body.name || !body.url || !body.events) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "Name, URL, and events are required"
      });
    }
    try {
      new URL(body.url);
    } catch {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "Invalid URL format"
      });
    }
    const validEvents = [
      "entry.create",
      "entry.update",
      "entry.delete",
      "entry.publish",
      "entry.unpublish",
      "entry.preview.invalidate"
    ];
    const events = Array.isArray(body.events) ? body.events : [body.events];
    for (const event2 of events) {
      if (!validEvents.includes(event2)) {
        throw createError({
          statusCode: 400,
          statusMessage: "Bad Request",
          message: `Invalid event: ${event2}. Valid events are: ${validEvents.join(", ")}`
        });
      }
    }
    const webhook = await createWebhook({
      name: body.name,
      url: body.url,
      events,
      content_types: body.content_types || ["*"],
      enabled: body.enabled !== false,
      secret: body.secret,
      headers: body.headers
    });
    auditFromEvent(event, "webhook.create", {
      target: { entityType: "webhook", entityId: webhook.id, displayName: webhook.name },
      metadata: {
        url: webhook.url,
        events,
        contentTypes: body.content_types || ["*"],
        hasSecret: Boolean(webhook.secret)
      }
    });
    return {
      success: true,
      data: {
        ...webhook,
        events: JSON.parse(webhook.events),
        content_types: JSON.parse(webhook.content_types),
        headers: webhook.headers ? JSON.parse(webhook.headers) : {},
        enabled: webhook.enabled === 1 || webhook.enabled === true,
        secret: void 0
      }
    };
  } catch (error) {
    if (error && typeof error === "object" && "statusCode" in error) {
      throw error;
    }
    if (isSsrfGuardError(error)) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: error instanceof Error ? error.message : "Invalid webhook URL"
      });
    }
    console.error("[POST /api/webhooks] Error:", error);
    throw createError({
      statusCode: 500,
      statusMessage: "Failed to create webhook",
      message: error instanceof Error ? error.message : "Unknown error"
    });
  }
});

export { index_post as default };
//# sourceMappingURL=index.post3.mjs.map
