globalThis.process ??= {};
globalThis.process.env ??= {};
import { r as __exportAll } from "./rolldown-runtime_-UtK6b3T.mjs";
import { W as ContentValidationError, c as isEntityId, d as mapContentError, u as jsonOk } from "./crypto_CY2zBtG3.mjs";
import { r as buildAuthEngine } from "./admin-engine_Cqzo5vQB.mjs";
import { c as assertCsrf, i as requireAdmin } from "./auth_B0DWM0G6.mjs";
import { t as assertNotLastAdmin } from "./user-admin_2xqfiQoM.mjs";
import { env } from "cloudflare:workers";
//#region src/pages/api/admin/users/[id]/roles.ts
var roles_exports = /* @__PURE__ */ __exportAll({
	PATCH: () => PATCH,
	prerender: () => false
});
var ROLE_OPTIONS = [
	"viewer",
	"editor",
	"admin"
];
function parseRoles(raw) {
	if (!Array.isArray(raw)) throw new ContentValidationError("roles", "must be an array");
	for (const role of raw) if (typeof role !== "string" || !ROLE_OPTIONS.includes(role)) throw new ContentValidationError("roles", "invalid role value");
	return raw;
}
var PATCH = async ({ request, cookies, params }) => {
	try {
		const { authMode } = await requireAdmin(request, env, cookies);
		assertCsrf(request, {
			authMode,
			siteOrigin: env.SITE_ORIGIN
		});
		const userId = params.id;
		if (!isEntityId(userId)) throw new ContentValidationError("id", "must be a valid UUID");
		const data = await request.json();
		if (typeof data !== "object" || data === null) throw new ContentValidationError("input", "must be an object");
		const roles = parseRoles(data.roles);
		const engine = buildAuthEngine(env);
		await assertNotLastAdmin(engine, userId, roles);
		await engine.setUserRoles(userId, roles);
		return jsonOk({ ok: true });
	} catch (error) {
		return mapContentError(error);
	}
};
//#endregion
//#region \0virtual:astro:page:src/pages/api/admin/users/[id]/roles@_@ts
var page = () => roles_exports;
//#endregion
export { page };
