import { NextRequest, NextResponse } from 'next/server'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import sql from '@/lib/db'
import { randomBytes } from 'crypto'

export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
  const session = await getServerSession(authOptions)
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const { id } = await params
  const newKey = randomBytes(32).toString('hex')

  const [app] = await sql`
    UPDATE apps SET api_key = ${newKey}
    WHERE id = ${id}
    RETURNING api_key
  `

  await sql`
    INSERT INTO audit_logs (app_id, action, actor)
    VALUES (${id}, 'rotate_key', ${session.user?.name ?? 'admin'})
  `

  return NextResponse.json({ api_key: app.api_key })
}