import { NextResponse } from "next/server";
import { z } from "zod";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
import { UserConsent } from "@open-mercato/core/modules/auth/data/entities";
import { verifyConsentIntegrityHash } from "@open-mercato/core/modules/auth/lib/consentIntegrity";
import { assertActorCanAccessUserTarget } from "@open-mercato/core/modules/auth/lib/grantChecks";
import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
const metadata = {
  path: "/auth/users/consents",
  GET: {
    requireAuth: true,
    requireFeatures: ["auth.users.edit"]
  }
};
const querySchema = z.object({
  userId: z.string().uuid()
});
async function GET(req) {
  const auth = await getAuthFromRequest(req);
  if (!auth) {
    return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
  }
  const url = new URL(req.url);
  const parsed = querySchema.safeParse({ userId: url.searchParams.get("userId") });
  if (!parsed.success) {
    return NextResponse.json({ ok: false, error: "Invalid userId" }, { status: 400 });
  }
  const container = await createRequestContainer();
  const em = container.resolve("em");
  const tenantId = auth.tenantId ?? null;
  const organizationId = auth.orgId ?? null;
  if (auth.sub) {
    try {
      await assertActorCanAccessUserTarget({
        em,
        rbacService: container.resolve("rbacService"),
        actorUserId: auth.sub,
        tenantId,
        organizationId,
        targetUserId: parsed.data.userId
      });
    } catch (err) {
      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
      throw err;
    }
  }
  const consents = await findWithDecryption(
    em,
    UserConsent,
    {
      userId: parsed.data.userId,
      deletedAt: null,
      ...tenantId ? { tenantId } : {},
      ...organizationId ? { organizationId } : {}
    },
    { orderBy: { createdAt: "DESC" } },
    { tenantId, organizationId }
  );
  const items = consents.map((c) => ({
    id: c.id,
    consentType: c.consentType,
    isGranted: c.isGranted,
    grantedAt: c.grantedAt?.toISOString() ?? null,
    withdrawnAt: c.withdrawnAt?.toISOString() ?? null,
    source: c.source ?? null,
    ipAddress: c.ipAddress ?? null,
    integrityValid: verifyConsentIntegrityHash({
      userId: c.userId,
      consentType: c.consentType,
      isGranted: c.isGranted,
      grantedAt: c.grantedAt,
      withdrawnAt: c.withdrawnAt,
      ipAddress: c.ipAddress,
      source: c.source
    }, c.integrityHash),
    createdAt: c.createdAt.toISOString(),
    updatedAt: c.updatedAt?.toISOString() ?? null
  }));
  return NextResponse.json({ ok: true, items });
}
var route_default = GET;
const consentsGetDoc = {
  summary: "List user consents",
  description: "Returns all consent records for a given user, with integrity verification status.",
  tags: ["Auth"],
  query: querySchema,
  responses: [
    { status: 200, description: "Consent list returned" }
  ]
};
const openApi = {
  tag: "Auth",
  summary: "User consents",
  methods: {
    GET: consentsGetDoc
  }
};
export {
  GET,
  route_default as default,
  metadata,
  openApi
};
//# sourceMappingURL=route.js.map
