import { z } from 'zod'

const bodySchema = z.object({
  name: z.string().trim().min(2).max(50).regex(/^[\w-]+$/, 'Nur Buchstaben, Zahlen, - und _'),
})

export default defineEventHandler(async (event) => {
  const actor = await requirePermission(event, 'roles.manage')
  const { name } = await readValidatedBody(event, bodySchema.parse)
  const id = await ensureRole(name)
  await logAudit(actor.id, 'create_role', { type: 'role', id }, { name })
  return { id, name }
})