export default defineEventHandler(async (event) => {
  const { owner } = assertLibraryOwner(event)
  const body = await readBody<{ folderId?: string; password?: string; currentPassword?: string }>(event)
  const folderId = String(body?.folderId || '')
  if (!folderId) {
    throw createError({ statusCode: 400, statusMessage: 'Choose a folder to protect' })
  }
  await updateFolder(owner, folderId, {
    password: body?.password ?? '',
    currentPassword: body?.currentPassword
  })
  const folder = assertLibraryOwner(event).catalog.folders.find(item => item.id === folderId)
  if (folder?.passwordHash) {
    setFolderUnlock(event, folder.id, passwordVersion(folder.passwordHash))
  } else {
    clearFolderUnlock(event, folderId)
  }
  return publicLibrary(event)
})