import { z } from 'zod';
import { requireAdmin } from '../../../utils/auth';
import { updateOrderStatus } from '../../../utils/store';
import { recordAudit } from '../../../utils/audit';

const schema = z.object({ status: z.enum(['pending', 'paid', 'shipped', 'canceled']) });

export default defineEventHandler(async (event) => {
  const admin = await requireAdmin(event);
  const id = getRouterParam(event, 'id')!;
  const parsed = schema.safeParse(await readBody(event).catch(() => ({})));
  if (!parsed.success) throw createError({ statusCode: 400, statusMessage: 'Invalid status' });
  const order = await updateOrderStatus(id, parsed.data.status);
  await recordAudit({ actorId: admin.id, action: 'order.status', target: id, meta: { status: parsed.data.status } });
  return { order: { id: order.id, status: order.status } };
});