/**
 * DELETE /api/admin/sessions/:id: signs one session out. Your own: always. Another admin's: owners (admins.sessions)
 * with a fresh step-up. Revokes the session's Cognito refresh token too.
 */
export const DELETE = adminRoute(null, async (_request, ctx, { params }: Context, { session: current }) => {
  const { id } = await params;
  if (!/^[0-9a-f]{64}$/.test(id)) throw notFound("Session");
  const target = await sessions.get(sessionPk(id), SESSION_SK);
  if (!target) throw notFound("Session");
  if (target.staffSub !== ctx.admin.sub) {
    if (!can(ctx.admin.role, "admins.sessions")) throw new CloudError(403, "forbidden", "Your admin role doesn't allow this.");
    if (!stepUpFresh(current)) throw stepUpRequired();
  }
  const revoked = await revokeSession(id, ctx.admin.sub);
  await revokeRefreshToken(revoked?.cognitoRefreshToken);
  await authAudit({ action: "admin.session.revoke", outcome: "ok", actorSub: ctx.admin.sub, role: ctx.admin.role, sessionId: ctx.sessionId, requestId: ctx.requestId, targetId: id, ip: ctx.ip, userAgent: ctx.userAgent });
  const response = new NextResponse(null, { status: 204 });
  if (id === ctx.sessionId) clearSessionCookie(response.cookies);
  return response;
});