import { NextRequest, NextResponse } from 'next/server';
import { getSession } from '@/lib/session';
import { listPasskeys, deletePasskey } from '@/lib/passkeys';

// Liste der eigenen Passkeys (ohne öffentlichen Schlüssel).
export async function GET() {
  const session = await getSession();
  if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 });

  try {
    const passkeys = (await listPasskeys(session.username)).map((pk) => ({
      credentialId: pk.credentialId,
      label: pk.label,
      createdAt: pk.createdAt,
      lastUsedAt: pk.lastUsedAt,
    }));
    return NextResponse.json({ passkeys });
  } catch (error) {
    console.error('GET /api/passkey:', error);
    return NextResponse.json({ error: 'Serverfehler' }, { status: 500 });
  }
}

// Löscht einen eigenen Passkey anhand seiner credentialId (?id=...).
export async function DELETE(request: NextRequest) {
  const session = await getSession();
  if (!session) return NextResponse.json({ error: 'Nicht angemeldet' }, { status: 401 });

  const id = request.nextUrl.searchParams.get('id');
  if (!id) return NextResponse.json({ error: 'Keine ID angegeben.' }, { status: 400 });

  try {
    const removed = await deletePasskey(id, session.username);
    if (!removed) return NextResponse.json({ error: 'Passkey nicht gefunden.' }, { status: 404 });
    return NextResponse.json({ ok: true });
  } catch (error) {
    console.error('DELETE /api/passkey:', error);
    return NextResponse.json({ error: 'Serverfehler' }, { status: 500 });
  }
}