import { getAdmin } from "../../../../../../lib/admin-auth";
import {
  audit,
  publicUrl,
  sameOrigin,
} from "../../../../../../lib/admin-operations";
import { env } from "../../../../../../lib/server-env";

export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> },
) {
  const admin = await getAdmin();
  if (!admin) return Response.json({ error: "unauthorized" }, { status: 401 });
  if (!sameOrigin(request))
    return Response.json({ error: "invalid_origin" }, { status: 403 });
  const { id } = await params,
    now = new Date().toISOString();
  const application = await env.DB.prepare(
    "SELECT public_number FROM applications WHERE id=? AND deleted_at IS NULL",
  )
    .bind(id)
    .first<{ public_number: string }>();
  if (!application)
    return Response.json({ error: "not_found" }, { status: 404 });
  await env.DB.prepare(
    "UPDATE applications SET deleted_at=?,updated_at=? WHERE id=?",
  )
    .bind(now, now, id)
    .run();
  await audit(
    admin.userId,
    "APPLICATION_REMOVED_FROM_LIST",
    "APPLICATION",
    id,
    { publicNumber: application.public_number },
  );
  return Response.redirect(publicUrl(request, "/administracao?removed=1"), 303);
}