import { NextResponse } from "next/server";
import { query } from "@/lib/db";
import { requireSession, UnauthorizedError } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

export async function DELETE(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    const session = await requireSession();
    const { id } = await params;
    // user_id-Filter stellt sicher, dass nur eigene Credentials gelöscht
    // werden können.
    await query("delete from passkey_credentials where id = $1 and user_id = $2", [
      id,
      session.user.id,
    ]);
    return NextResponse.json({ ok: true });
  } catch (err) {
    if (err instanceof UnauthorizedError) {
      return NextResponse.json({ error: "unauthorized" }, { status: 401 });
    }
    throw err;
  }
}