{
  "oneOf": [
    {
      "type": "object",
      "properties": {
        "role": {
          "type": "string",
          "enum": [
            "owner",
            "support",
            "billing",
            "readonly"
          ]
        }
      },
      "required": [
        "role"
      ],
      "additionalProperties": false
    },
    {
      "type": "object",
      "properties": {
        "status": {
          "type": "string",
          "enum": [
            "active",
            "disabled"
          ]
        }
      },
      "required": [
        "status"
      ],
      "additionalProperties": false
    }
  ]
}

/**
 * PATCH /api/admin/admins/:sub {role} | {status: "active"|"disabled"} (admins.role / admins.disable, step-up).
 * Refused (409) for your own role or status and when no active owner would remain; disabling also revokes every
 * session. Audited in admins.ts.
 */
export const PATCH = adminRoute("admins.role", async (request, ctx, { params }: Context) => {
  const { sub } = await params;
  if (!SUB.test(sub)) throw new CloudError(404, "not_found", "Admin not found.");
  const input = await readBody(request, body);
  if ("role" in input) return adminJson({ admin: await setRole(ctx, sub, input.role) });
  if (!can(ctx.admin.role, "admins.disable")) throw new CloudError(403, "forbidden", "Your admin role doesn't allow this.");
  return adminJson(await setStatus(ctx, sub, input.status));
});