import { eq } from 'drizzle-orm'
import { roles } from '../../../db/schema'
import { SYSTEM_ROLES } from '../../../../shared/utils/permissions'

export default defineEventHandler(async (event) => {
  const actor = await requirePermission(event, 'roles.manage')
  const id = Number(getRouterParam(event, 'id'))
  if (!Number.isInteger(id) || id <= 0) {
    throw createError({ statusCode: 400, statusMessage: 'Ungültige ID' })
  }
  const db = useDb()
  const existing = await db.select({ name: roles.name }).from(roles).where(eq(roles.id, id)).limit(1)
  if (!existing[0]) {
    throw createError({ statusCode: 404, statusMessage: 'Rolle nicht gefunden' })
  }
  if ((SYSTEM_ROLES as readonly string[]).includes(existing[0].name)) {
    throw createError({ statusCode: 400, statusMessage: `Die ${existing[0].name}-Rolle kann nicht gelöscht werden` })
  }
  await db.delete(roles).where(eq(roles.id, id))
  await logAudit(actor.id, 'delete_role', { type: 'role', id }, { name: existing[0].name })
  return { ok: true }
})