import { Inject, Injectable } from '@nestjs/common';
import type { FastifyRequest } from 'fastify';
import { AUDIT_REPOSITORY, type AuditEntryInput, type AuditRepository } from './audit.repository.js';
import { redactSensitive } from './redact.js';
import type { AuthenticatedRequest } from '../security/security.metadata.js';

@Injectable()
export class AuditService {
  constructor(@Inject(AUDIT_REPOSITORY) private readonly repository: AuditRepository) {}

  async write(input: AuditEntryInput): Promise<void> {
    await this.repository.write({
      ...input,
      beforeSummary: redactSensitive(input.beforeSummary),
      afterSummary: redactSensitive(input.afterSummary)
    });
  }

  baseFromRequest(request: FastifyRequest): Pick<AuditEntryInput, 'requestId' | 'userId' | 'username' | 'roleNames' | 'ip' | 'userAgent'> {
    const authRequest = request as AuthenticatedRequest;
    const requestIdHeader = request.headers['x-request-id'];

    return {
      requestId: requestIdHeader?.toString() ?? request.id,
      userId: authRequest.currentUser?.id,
      username: authRequest.currentUser?.username,
      roleNames: authRequest.currentUser?.roles.join(','),
      ip: request.ip,
      userAgent: request.headers['user-agent']
    };
  }
}