import { NextResponse } from "next/server";
import { z } from "zod";
import { getCustomerAuthFromRequest, readCookieFromHeader } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import { CustomerUserSession } from "@open-mercato/core/modules/customer_accounts/data/entities";
import { hashToken } from "@open-mercato/core/modules/customer_accounts/lib/tokenGenerator";
const metadata = { requireAuth: false };
async function DELETE(req, { params }) {
  const auth = await getCustomerAuthFromRequest(req);
  if (!auth) {
    return NextResponse.json({ ok: false, error: "Authentication required" }, { status: 401 });
  }
  const sessionId = params.id;
  const container = await createRequestContainer();
  const em = container.resolve("em");
  const customerSessionService = container.resolve("customerSessionService");
  const session = await em.findOne(CustomerUserSession, {
    id: sessionId,
    user: auth.sub,
    deletedAt: null
  });
  if (!session) {
    return NextResponse.json({ ok: false, error: "Session not found" }, { status: 404 });
  }
  const cookieHeader = req.headers.get("cookie") || "";
  const sessionToken = readCookieFromHeader(cookieHeader, "customer_session_token");
  if (sessionToken) {
    try {
      const currentHash = hashToken(decodeURIComponent(sessionToken));
      if (session.tokenHash === currentHash) {
        return NextResponse.json({ ok: false, error: "Cannot revoke current session. Use logout instead." }, { status: 400 });
      }
    } catch {
    }
  }
  await customerSessionService.revokeSession(sessionId);
  return NextResponse.json({ ok: true });
}
const successSchema = z.object({ ok: z.literal(true) });
const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
const methodDoc = {
  summary: "Revoke a customer session",
  description: "Revokes a specific session (not the current one).",
  tags: ["Customer Portal"],
  responses: [{ status: 200, description: "Session revoked", schema: successSchema }],
  errors: [
    { status: 400, description: "Cannot revoke current session", schema: errorSchema },
    { status: 401, description: "Not authenticated", schema: errorSchema },
    { status: 404, description: "Session not found", schema: errorSchema }
  ]
};
const openApi = {
  summary: "Revoke customer session",
  pathParams: z.object({ id: z.string().uuid() }),
  methods: { DELETE: methodDoc }
};
export {
  DELETE,
  metadata,
  openApi
};
//# sourceMappingURL=%5Bid%5D.js.map
