import { NextRequest, NextResponse } from "next/server"
import { requireAdmin } from "@/lib/api-auth"
import { accountAuthorizationService } from "@/lib/admin-authorization-service"
import { auditLogService } from "@/lib/audit-log-service"

export const dynamic = "force-dynamic"

export async function DELETE(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  const auth = await requireAdmin(request)
  if (auth.error) return auth.error

  const { id } = await params
  const idNum = parseInt(id, 10)
  if (Number.isNaN(idNum)) {
    return NextResponse.json({ error: "Invalid id" }, { status: 400 })
  }

  try {
    const row = await accountAuthorizationService.getById(idNum)
    if (!row) {
      return NextResponse.json({ error: "Authorization not found" }, { status: 404 })
    }

    await accountAuthorizationService.deleteById(idNum)

    await auditLogService.log({
      adminUserId: auth.profile.user_id,
      action: "authorization_revoked",
      targetType: "account_authorization",
      targetId: String(idNum),
      targetName: `user ${row.user_id} → business ${row.business_id}`,
      details: { business_id: row.business_id, user_id: row.user_id },
    })

    return NextResponse.json({ ok: true })
  } catch (e) {
    console.error("DELETE /api/admin/authorizations/[id]:", e)
    return NextResponse.json(
      { error: e instanceof Error ? e.message : "Failed to revoke authorization" },
      { status: 500 }
    )
  }
}