import { errorResponse, requireSameOrigin } from "@/lib/security/http";
import { limitRequest } from "@/lib/security/rate-limit";
import * as z from "zod";

import { requireAdmin } from "@/lib/auth/server";
import { discardUnreferencedMedia } from "@/lib/media/repository";
import { auditActor } from "@/lib/audit-log";

export async function DELETE(
  request: Request,
  context: { params: Promise<{ id: string }> },
) {
  try {
    requireSameOrigin(request);
    const admin = await requireAdmin();
    await limitRequest("media", admin.user.id, 20);
    const { id } = await context.params;
    if (!z.string().uuid().safeParse(id).success) {
      return Response.json({ error: "invalid-id" }, { status: 400 });
    }
    const deleted = await discardUnreferencedMedia(id, auditActor(admin.user));
    return deleted
      ? new Response(null, { status: 204 })
      : Response.json({ error: "media-is-referenced-or-missing" }, { status: 409 });
  } catch (cause) {
    return errorResponse(cause);
  }
}