globalThis.process ??= {};
globalThis.process.env ??= {};
import { r as __exportAll } from "./rolldown-runtime_-UtK6b3T.mjs";
import { d as mapContentError, l as jsonError, u as jsonOk } from "./crypto_CY2zBtG3.mjs";
import { f as requireRole } from "./engine-custom_BJVTPCgT.mjs";
import { i as buildServiceTokenResolver, r as buildAuthEngine, t as ROLE_HIERARCHY } from "./admin-engine_Cqzo5vQB.mjs";
import { c as assertCsrf, s as resolveSession } from "./auth_B0DWM0G6.mjs";
import { n as getSubmissionStore, r as mapFormError } from "./forms_B0iuHQPP.mjs";
import { env } from "cloudflare:workers";
//#region src/pages/api/admin/submissions.ts
var submissions_exports = /* @__PURE__ */ __exportAll({
	DELETE: () => DELETE,
	GET: () => GET,
	prerender: () => false
});
var ALLOWED_FORM_IDS = /* @__PURE__ */ new Set(["contact"]);
function parseFormId(raw) {
	const formId = raw?.trim() || "contact";
	if (!ALLOWED_FORM_IDS.has(formId)) throw Object.assign(/* @__PURE__ */ new Error("forbidden form"), { name: "FormScopeError" });
	return formId;
}
var GET = async ({ request, cookies, url }) => {
	try {
		const { principal } = await resolveSession(request, buildAuthEngine(env), cookies, buildServiceTokenResolver(env));
		requireRole("admin", ROLE_HIERARCHY)(principal);
		const formId = parseFormId(url.searchParams.get("formId"));
		const cursor = url.searchParams.get("cursor") ?? void 0;
		const includeSpam = url.searchParams.get("includeSpam") === "true";
		const result = await getSubmissionStore(env).list(formId, {
			...cursor ? { cursor } : {},
			includeSpam
		});
		return jsonOk(result);
	} catch (error) {
		if (error.name === "FormScopeError") return jsonError(403, "forbidden", "That form is not accessible.");
		const mapped = mapFormError(error);
		if (mapped.status !== 500) return mapped;
		return mapContentError(error);
	}
};
function parseDeleteBody(data) {
	if (typeof data !== "object" || data === null) throw new Error("validation");
	const raw = data;
	const formId = typeof raw.formId === "string" && raw.formId.trim() ? raw.formId.trim() : "contact";
	if (!ALLOWED_FORM_IDS.has(formId)) throw Object.assign(/* @__PURE__ */ new Error("forbidden form"), { name: "FormScopeError" });
	const id = raw.id;
	if (typeof id !== "string" || !id.trim()) throw new Error("validation");
	return {
		formId,
		id: id.trim()
	};
}
var DELETE = async ({ request, cookies }) => {
	try {
		const { principal, authMode } = await resolveSession(request, buildAuthEngine(env), cookies, buildServiceTokenResolver(env));
		requireRole("admin", ROLE_HIERARCHY)(principal);
		assertCsrf(request, {
			authMode,
			siteOrigin: env.SITE_ORIGIN
		});
		let body;
		try {
			body = await request.json();
		} catch {
			return jsonError(400, "validation_error", "Invalid request body.");
		}
		const { formId, id } = parseDeleteBody(body);
		await getSubmissionStore(env).delete(formId, id);
		return jsonOk({
			ok: true,
			id
		});
	} catch (error) {
		if (error.message === "validation") return jsonError(400, "validation_error", "Invalid delete request.");
		if (error.name === "FormScopeError") return jsonError(403, "forbidden", "That form is not accessible.");
		const mapped = mapFormError(error);
		if (mapped.status !== 500) return mapped;
		return mapContentError(error);
	}
};
//#endregion
//#region \0virtual:astro:page:src/pages/api/admin/submissions@_@ts
var page = () => submissions_exports;
//#endregion
export { page };
