import { d as defineEventHandler, r as requireAuth, c as createError, cI as requireAdminScope, i as requireApiTokenScopes, q as readBody, f5 as rotateWebhookSecret } from '../../../../nitro/nitro.mjs';
import { a as auditFromEvent } from '../../../../_/audit-log-helpers.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';
import '../../../../_/audit-log-actor.mjs';

const rotateSecret_post = defineEventHandler(async (event) => {
  var _a, _b, _c;
  try {
    await requireAuth(event);
    if (!event.context.adminUser) {
      throw createError({
        statusCode: 403,
        statusMessage: "Forbidden",
        message: "Only administrators can rotate webhook secrets"
      });
    }
    await requireAdminScope(event, "webhooks:write");
    requireApiTokenScopes(event.context.apiToken, { scopes: ["webhooks:write"] });
    const id = (_a = event.context.params) == null ? void 0 : _a.id;
    if (!id) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "Webhook ID is required"
      });
    }
    const numericId = parseInt(id);
    if (isNaN(numericId)) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "ID must be a valid number"
      });
    }
    const body = (_b = await readBody(event)) != null ? _b : {};
    const ttl = body.previousTtlSeconds;
    if (ttl !== void 0) {
      if (!Number.isInteger(ttl) || ttl < 0 || ttl > 30 * 24 * 60 * 60) {
        throw createError({
          statusCode: 400,
          statusMessage: "Bad Request",
          message: "previousTtlSeconds must be an integer between 0 and 2592000 (30 days)"
        });
      }
    }
    const { webhook, newSecret } = await rotateWebhookSecret(numericId, {
      previousTtlSeconds: ttl
    });
    auditFromEvent(event, "webhook.rotate_secret", {
      target: { entityType: "webhook", entityId: webhook.id, displayName: webhook.name },
      metadata: {
        previousTtlSeconds: ttl != null ? ttl : 24 * 60 * 60,
        previousActive: Boolean(webhook.secret_previous)
      }
    });
    return {
      success: true,
      data: {
        id: webhook.id,
        name: webhook.name,
        secretPreviousExpiresAt: webhook.secret_previous_expires_at
      },
      newSecret
    };
  } catch (error) {
    if (error && typeof error === "object" && "statusCode" in error) {
      throw error;
    }
    const message = error instanceof Error ? error.message : "Unknown error";
    if (message === "Webhook not found") {
      throw createError({
        statusCode: 404,
        statusMessage: "Not Found",
        message
      });
    }
    console.error(`[POST /api/webhooks/${(_c = event.context.params) == null ? void 0 : _c.id}/rotate-secret] Error:`, error);
    throw createError({
      statusCode: 500,
      statusMessage: "Failed to rotate webhook secret",
      message
    });
  }
});

export { rotateSecret_post as default };
//# sourceMappingURL=rotate-secret.post.mjs.map
