import { f as defineAdminEventHandler, W as requireAdminAuth, c as createError, a5 as isMfaEnabledGlobally, a7 as isMfaRequiredForRole, q as readBody, ag as findAdminUserById, a6 as getAdminMfaState, ah as comparePassword, ai as verifyTotp, ad as logAuditEventAsync, t as getAdminActor, aj as deactivateMfa } from '../../../../../nitro/nitro.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';

const disable_post = defineAdminEventHandler("admin:auth:mfa:disable", async (event) => {
  await requireAdminAuth(event);
  const ctxUser = event.context.adminUser;
  if (!ctxUser) {
    throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
  }
  if (isMfaEnabledGlobally() && isMfaRequiredForRole(ctxUser.role)) {
    throw createError({
      statusCode: 403,
      statusMessage: "Forbidden",
      message: "MFA is required for your role and cannot be disabled. Contact a super-admin to reset."
    });
  }
  const body = await readBody(event);
  const password = body == null ? void 0 : body.password;
  const code = body == null ? void 0 : body.code;
  if (!password && !code) {
    throw createError({
      statusCode: 400,
      statusMessage: "Bad Request",
      message: "Either password or current TOTP code is required"
    });
  }
  const adminUser = await findAdminUserById(ctxUser.id);
  if (!adminUser) {
    throw createError({
      statusCode: 401,
      statusMessage: "Unauthorized",
      message: "User not found"
    });
  }
  const state = await getAdminMfaState(adminUser.id);
  if (!state || !state.enabled || !state.secret) {
    throw createError({
      statusCode: 400,
      statusMessage: "Bad Request",
      message: "MFA is not enabled"
    });
  }
  let confirmed = false;
  if (password) {
    confirmed = await comparePassword(password, adminUser.password);
  }
  if (!confirmed && code) {
    confirmed = verifyTotp(state.secret, code.trim());
  }
  if (!confirmed) {
    logAuditEventAsync({
      action: "mfa.failed",
      actor: getAdminActor(event),
      target: { entityType: "admin_user", entityId: adminUser.id, displayName: adminUser.username },
      outcome: "failed",
      metadata: { phase: "disable" }
    });
    throw createError({
      statusCode: 401,
      statusMessage: "Unauthorized",
      message: "Invalid password or TOTP code"
    });
  }
  await deactivateMfa(adminUser.id);
  logAuditEventAsync({
    action: "mfa.disabled",
    actor: getAdminActor(event),
    target: { entityType: "admin_user", entityId: adminUser.id, displayName: adminUser.username },
    outcome: "success"
  });
  return { success: true, data: { disabled: true } };
});

export { disable_post as default };
//# sourceMappingURL=disable.post.mjs.map
