export default defineEventHandler(async (event) => {
  const body = await readBody<{ password?: string; currentPassword?: string }>(event)
  if (isLibraryLocked() && !(await verifyLibraryPassword(String(body?.currentPassword || '')))) {
    throw createError({ statusCode: 401, statusMessage: 'Current library password is incorrect' })
  }
  const next = String(body?.password || '').trim()
  if (next && next.length < 4) {
    throw createError({ statusCode: 400, statusMessage: 'Use at least 4 characters, or leave blank to remove the password' })
  }
  const version = await setLibraryPassword(next || null)
  if (next) setLibraryUnlock(event, version)
  else clearLibraryUnlock(event)
  return publicLibrary(event)
})