/**
 * POST /api/users/freeze — foundation-auth-rbac (Task 14).
 *
 * Guarded requirePermission('users:freeze'). Sets the target membership
 * status='frozen' + freeze_reason, revokes ALL the target's refresh tokens for
 * the tenant (audited transaction in freezeMembership), then bumpUserVersion
 * for immediate (<=60s) session revocation. Mounted behind authMiddleware.
 */
import { Hono } from 'hono'
import { createDb, freezeMembership } from '@zync/db/queries'
import type { TenantId, UserId } from '@zync/types'
import type { AppEnv } from '../../types'
import { freezeSchema } from '../../schemas/auth'
import { requirePermission } from '../../middleware/guards'
import { bumpUserVersion } from '../../middleware/user-version'

export const freezeRoute = new Hono<AppEnv>()

freezeRoute.post('/freeze', requirePermission('users:freeze'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }
  const parsed = freezeSchema.safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Invalid request' }, 400)
  }
  const { userId, reason } = parsed.data

  const db = createDb(c.env)
  await freezeMembership(db, {
    tenantId: session.tid as TenantId,
    targetUserId: userId as UserId,
    reason,
    actorId: session.sub as UserId,
    actorIp: c.req.header('CF-Connecting-IP') ?? null,
    requestId: c.req.header('CF-Ray') ?? null,
  })

  // Immediate session revocation across PoPs.
  await bumpUserVersion(c.env, userId)

  return c.json({ status: 'frozen' }, 200)
})