import { f as defineAdminEventHandler, W as requireAdminAuth, c as createError, a5 as isMfaEnabledGlobally, a7 as isMfaRequiredForRole, a6 as getAdminMfaState, af as getStepUpMaxAgeSeconds } from '../../../../../nitro/nitro.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';

const status_get = defineAdminEventHandler("admin:auth:mfa:status", async (event) => {
  var _a, _b, _c;
  await requireAdminAuth(event);
  const ctxUser = event.context.adminUser;
  if (!ctxUser) {
    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
  }
  const globallyEnabled = isMfaEnabledGlobally();
  const required = globallyEnabled && isMfaRequiredForRole(ctxUser.role);
  const state = await getAdminMfaState(ctxUser.id);
  const jwtCtx = event.context.adminJwt;
  const stepUpMaxAge = getStepUpMaxAgeSeconds();
  const now = Math.floor(Date.now() / 1e3);
  const stepUpFresh = Boolean(state == null ? void 0 : state.enabled) && Boolean(jwtCtx == null ? void 0 : jwtCtx.amr.includes("mfa")) && typeof (jwtCtx == null ? void 0 : jwtCtx.mvAt) === "number" && now - jwtCtx.mvAt < stepUpMaxAge;
  return {
    success: true,
    data: {
      globallyEnabled,
      required,
      enabled: Boolean(state == null ? void 0 : state.enabled),
      enrolledAt: (_a = state == null ? void 0 : state.enrolledAt) != null ? _a : null,
      recoveryCodesRemaining: (_b = state == null ? void 0 : state.recoveryHashes.length) != null ? _b : 0,
      hasPendingEnrollment: Boolean(state == null ? void 0 : state.pendingSecret),
      stepUp: {
        maxAgeSeconds: stepUpMaxAge,
        fresh: stepUpFresh,
        verifiedAt: (_c = jwtCtx == null ? void 0 : jwtCtx.mvAt) != null ? _c : null
      }
    }
  };
});

export { status_get as default };
//# sourceMappingURL=status.get.mjs.map
