import { f as defineAdminEventHandler, aA as requireSuperAdmin, O as requireMfaStepUp, c as createError, ag as findAdminUserById, a6 as getAdminMfaState, aj as deactivateMfa, dk as clearMfaPendingSecret, ad as logAuditEventAsync, t as getAdminActor } from '../../../../../nitro/nitro.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';

const mfa_delete = defineAdminEventHandler("admin:users:mfa:reset", async (event) => {
  var _a;
  await requireSuperAdmin(event);
  await requireMfaStepUp(event);
  const userId = Number((_a = event.context.params) == null ? void 0 : _a.id);
  if (!Number.isInteger(userId) || userId <= 0) {
    throw createError({
      statusCode: 400,
      statusMessage: "Bad Request",
      message: "Invalid user id"
    });
  }
  const target = await findAdminUserById(userId, { includeInactive: true });
  if (!target) {
    throw createError({ statusCode: 404, statusMessage: "Not Found", message: "User not found" });
  }
  const state = await getAdminMfaState(userId);
  if (!state || !state.enabled && !state.pendingSecret) {
    return { success: true, data: { reset: false, alreadyDisabled: true } };
  }
  if (state.enabled) {
    await deactivateMfa(userId);
  } else {
    await clearMfaPendingSecret(userId);
  }
  logAuditEventAsync({
    action: "mfa.reset_by_admin",
    actor: getAdminActor(event),
    target: { entityType: "admin_user", entityId: userId, displayName: target.username },
    outcome: "success"
  });
  return { success: true, data: { reset: true } };
});

export { mfa_delete as default };
//# sourceMappingURL=mfa.delete.mjs.map
