<?php
// SPDX-License-Identifier: GPL-3.0-or-later
declare(strict_types=1);

namespace Aiwend\Audit;

use Aiwend\Db\Connection;
use Aiwend\Secrets\Redactor;
use Aiwend\Support\Clock;

/**
 * Minimal redacted audit trail (B11). Stores actor/action/object references,
 * never raw prompts or customer content. Retention defaults to 30 days
 * (provisional engineering value, configurable).
 */
final class AuditLog
{
    public function __construct(
        private Connection $db,
        private Redactor $redactor,
        private Clock $clock,
    ) {
    }

    public function record(int $siteId, string $actor, string $action, string $objectRef, string $outcome, ?string $requestId = null, ?string $detail = null): void
    {
        $this->db->insert('audit', [
            'site_id' => $siteId,
            'actor' => mb_substr($actor, 0, 100),
            'action' => mb_substr($action, 0, 100),
            'object_ref' => mb_substr($objectRef, 0, 191),
            'outcome' => mb_substr($outcome, 0, 32),
            'request_id' => $requestId,
            'detail' => $detail === null ? null : $this->redactor->summary($detail),
            'created_at' => $this->clock->now(),
        ]);
    }

    /** @return list<array<string, mixed>> */
    public function recent(int $siteId, int $limit = 50): array
    {
        return $this->db->select('SELECT actor, action, object_ref, outcome, request_id, detail, created_at FROM {audit} WHERE site_id = ? ORDER BY id DESC LIMIT ?', [$siteId, max(1, min(500, $limit))]);
    }

    public function purgeOlderThan(int $days): int
    {
        return $this->db->execute('DELETE FROM {audit} WHERE created_at < ?', [$this->clock->now() - $days * 86400]);
    }
}