<?php
/**
 * Admin action audit trail.
 *
 * @package LoyaltySpin
 */

namespace LoyaltyPress;

defined( 'ABSPATH' ) || exit;

/**
 * Insert-only audit log. IPs are stored as salted hashes only.
 */
class Audit {

	/**
	 * Log an action.
	 *
	 * @param string $action  Action key.
	 * @param string $ref     Object reference.
	 * @param array  $details Extra context.
	 */
	public static function log( $action, $ref = '', array $details = array() ) {
		global $wpdb;
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery
		$wpdb->insert(
			$wpdb->prefix . 'loyaltypress_audit_log',
			array(
				'actor_id'   => get_current_user_id(),
				'action'     => substr( sanitize_key( $action ), 0, 60 ),
				'object'     => substr( sanitize_text_field( $ref ), 0, 190 ),
				'details'    => wp_json_encode( $details ),
				'ip_hash'    => self::ip_hash(),
				'created_at' => current_time( 'mysql', true ),
			)
		);
	}

	/**
	 * Salted hash of the requester IP.
	 *
	 * @return string|null
	 */
	public static function ip_hash() {
		$ip = isset( $_SERVER['REMOTE_ADDR'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) : '';
		return $ip ? hash_hmac( 'sha256', $ip, wp_salt( 'auth' ) ) : null;
	}

	/**
	 * Recent entries.
	 *
	 * @param int $limit  Rows.
	 * @param int $offset Offset.
	 * @return array
	 */
	public static function recent( $limit = 50, $offset = 0 ) {
		global $wpdb;
		$table = $wpdb->prefix . 'loyaltypress_audit_log';
		// phpcs:ignore WordPress.DB.DirectDatabaseQuery,WordPress.DB.PreparedSQL.InterpolatedNotPrepared
		return (array) $wpdb->get_results( $wpdb->prepare( 'SELECT * FROM %i ORDER BY id DESC LIMIT %d OFFSET %d', $table, $limit, $offset ) );
	}
}