rfid-database/src/app/api/v1/tokens/[id]/route.ts

import { NextRequest } from "next/server";
import { and, eq } from "drizzle-orm";
import { requireApiUser, jsonError, jsonOk } from "@/lib/api/auth-guard";
import { getDb } from "@/db/client";
import { apiTokens } from "@/db/schema";

type Ctx = { params: Promise<{ id: string }> };

export async function DELETE(request: NextRequest, context: Ctx) {
  const userOrRes = await requireApiUser(request);
  if (userOrRes instanceof Response) return userOrRes;

  const { id } = await context.params;
  const db = getDb();
  const existing = db
    .select()
    .from(apiTokens)
    .where(and(eq(apiTokens.id, id), eq(apiTokens.userId, userOrRes.id)))
    .get();

  if (!existing) {
    return jsonError(404, "NOT_FOUND", "Token not found");
  }

  db.delete(apiTokens).where(eq(apiTokens.id, id)).run();
  return jsonOk({ ok: true });
}