import { dK as defineContentEventHandler, c as createError, dL as optionalAuth, bT as requirePermission, q as readBody, dX as createAssignment, ad as logAuditEventAsync, dU as broadcastAssignmentEvent } from '../../../../../nitro/nitro.mjs';
import { m as mapContentApiError } from '../../../../../_/api-helpers.mjs';
import { g as getAuditActorFromEvent } from '../../../../../_/audit-log-actor.mjs';
import 'node:crypto';
import 'jsonwebtoken';
import 'node:fs';
import 'node:module';
import 'node:path';
import 'node:url';
import 'node:http';
import 'node:https';
import 'node:events';
import 'node:buffer';
import 'pino';
import 'drizzle-orm/better-sqlite3';
import 'drizzle-orm/node-postgres';
import 'drizzle-orm/mysql2';
import 'better-sqlite3';
import 'pg';
import 'mysql2/promise';
import 'drizzle-orm';
import 'fs';
import 'path';
import 'prom-client';
import 'bcryptjs';
import '@node-rs/argon2';
import 'node:async_hooks';
import 'crypto';
import 'node:dns';
import 'node:util';
import 'node:net';
import 'fs/promises';
import 'url';
import 'semver';
import '../../../../../_/delivery-metrics.mjs';

const VALID_ROLES = ["reviewer", "editor", "approver"];
const index_post = defineContentEventHandler("update", async (event) => {
  var _a, _b, _c, _d, _e;
  try {
    const contentType = (_a = event.context.params) == null ? void 0 : _a.contentType;
    const id = (_b = event.context.params) == null ? void 0 : _b.id;
    if (!contentType || !id) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "Content type and ID are required"
      });
    }
    const numericId = parseInt(id);
    if (isNaN(numericId)) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "ID must be a valid number"
      });
    }
    await optionalAuth(event);
    await requirePermission(
      event.context.user,
      contentType,
      "update",
      event.context.adminUser,
      event.context.apiToken
    );
    const actor = getAuditActorFromEvent(event);
    if (!actor.id) {
      throw createError({
        statusCode: 401,
        statusMessage: "Unauthorized",
        message: "Authentication required to create assignments"
      });
    }
    const body = await readBody(event);
    if (!body.assigneeType || !["admin", "user"].includes(body.assigneeType)) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: 'assigneeType must be "admin" or "user"'
      });
    }
    if (!body.assigneeId || typeof body.assigneeId !== "number") {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: "assigneeId is required and must be a number"
      });
    }
    if (!body.role || !VALID_ROLES.includes(body.role)) {
      throw createError({
        statusCode: 400,
        statusMessage: "Bad Request",
        message: `role must be one of: ${VALID_ROLES.join(", ")}`
      });
    }
    const assignment = await createAssignment(contentType, numericId, actor, body);
    logAuditEventAsync({
      action: "assignment.create",
      actor,
      target: {
        entityType: contentType,
        entityId: numericId,
        displayName: `${body.role} \u2192 ${(_c = assignment.assignee.displayName) != null ? _c : `#${body.assigneeId}`}`
      },
      metadata: {
        assigneeType: body.assigneeType,
        assigneeId: body.assigneeId,
        role: body.role
      }
    });
    broadcastAssignmentEvent(contentType, numericId, "assignment.created", assignment, {
      type: actor.type,
      id: actor.id,
      displayName: actor.displayName || actor.email || `${actor.type}:${actor.id}`
    });
    return {
      success: true,
      data: assignment
    };
  } catch (error) {
    mapContentApiError(error, {
      routeLabel: `POST /api/content/${(_d = event.context.params) == null ? void 0 : _d.contentType}/${(_e = event.context.params) == null ? void 0 : _e.id}/assignments`
    });
  }
});

export { index_post as default };
//# sourceMappingURL=index.post.mjs.map
