Mebbling/app/api/admin/moderate/route.ts

import { NextResponse } from "next/server";
import { requireUser } from "@/lib/auth";
import { db } from "@/lib/db";
import { audit } from "@/lib/audit";
import { externalUrl } from "@/lib/http";
import { requireSameOrigin } from "@/lib/security";
import bcrypt from "bcryptjs";

export async function POST(request: Request) {
  try {
    requireSameOrigin(request); const admin = await requireUser(); if (admin.role !== "admin") throw new Error("Forbidden");
    const form = await request.formData(); const action = String(form.get("action")); const id = Number(form.get("id"));
    if (action === "hide-post") { db.prepare("UPDATE posts SET hidden=1,updated_at=CURRENT_TIMESTAMP WHERE id=?").run(id); db.prepare("UPDATE reports SET resolved=1 WHERE post_id=?").run(id); }
    else if (action === "restore-post") db.prepare("UPDATE posts SET hidden=0,updated_at=CURRENT_TIMESTAMP WHERE id=?").run(id);
    else if (action === "disable-user") { if (id === admin.id) throw new Error("Cannot disable yourself"); db.prepare("UPDATE users SET disabled=1 WHERE id=?").run(id); }
    else if (action === "enable-user") db.prepare("UPDATE users SET disabled=0 WHERE id=?").run(id);
    else if (action === "reset-password") { const password = String(form.get("password") || ""); if (password.length < 10) throw new Error("Invalid password"); db.prepare("UPDATE users SET password_hash=? WHERE id=?").run(await bcrypt.hash(password, 12), id); }
    else if (action === "resolve-report") db.prepare("UPDATE reports SET resolved=1 WHERE id=?").run(id);
    else throw new Error("Invalid action");
    audit(admin.id, `admin.${action}`, "admin-target", id);
    return NextResponse.redirect(externalUrl(request, "/admin?updated=1"));
  } catch { return NextResponse.redirect(externalUrl(request, "/admin?error=moderation")); }
}