// server/api/user/refresh-token.post.ts - 刷新当前登录用户的 apiToken
// 鉴权后生成新 token 写入数据库，不对外暴露旧 token 或内部错误
import { randomBytes } from "node:crypto";

import { setResponseStatus } from "h3";

import { prisma } from "~~/server/utils/db";
import { createApiLogger } from "~~/server/utils/logging";

export default defineEventHandler(async (event) => {
  const logger = createApiLogger(event, "api.user.refresh-token");

  const userId = event.context.auth!.user.id;
  const newToken = randomBytes(16).toString("hex");

  try {
    await prisma.user.update({
      where: { id: userId },
      data: { apiToken: newToken }
    });
  } catch (err) {
    logger.error("db_error", { userId, err: String(err) });
    setResponseStatus(event, 500);
    return { success: false, msg: "服务器内部错误" };
  }

  logger.info("finish_success", { userId });
  return { success: true, msg: "刷新成功", apiToken: newToken };
});