/**
 * Audit log types — tenant-audit-log spec.
 *
 * AuditEvent:    producer input (enqueued by mutation handlers via logAuditEvent).
 * AuditLogItem:  API response DTO (serialized from tenant_audit_log rows).
 * AuditEventGroup: filter dropdown groupings.
 * AUDIT_EVENT_TYPES: app-side catalog (no DB CHECK — deliberately open).
 * AUDIT_EVENT_GROUPS: event → group mapping for the filter UI.
 */

export type AuditEventGroup =
  | 'User'
  | 'Data'
  | 'Settings'
  | 'Auth'
  | 'Integration'
  | 'Bulk'
  | 'API Keys'

export interface AuditEvent {
  tenantId: string
  userId?: string
  actorName?: string
  actorEmail?: string
  eventType: string
  entityType?: string
  entityId?: string
  entityLabel?: string
  metadata?: Record<string, unknown>
  ipAddress?: string
}

export interface AuditLogItem {
  id: string
  event_type: string
  entity_type: string | null
  entity_id: string | null
  entity_label: string | null
  actor_name: string | null
  actor_email: string | null
  metadata: Record<string, unknown> | null
  ip_address: string | null
  /** Unix seconds (TIMESTAMPTZ serialized to epoch in response) */
  created_at: number
}

export const AUDIT_EVENT_TYPES = [
  // User Management
  'user.invited',
  'user.role_changed',
  'user.removed',
  'user.2fa_enforced',
  'user.frozen',
  'user.unfrozen',
  // Data Changes
  'customer.created',
  'customer.updated',
  'customer.deleted',
  'invoice.created',
  'invoice.updated',
  'invoice.status_changed',
  'invoice.sent',
  'invoice.paid',
  'invoice.voided',
  'project.created',
  'project.updated',
  'project.deleted',
  'expense.created',
  'expense.updated',
  'expense.deleted',
  'contract.signed',
  'contract.voided',
  // Settings
  'settings.updated',
  // Auth
  'auth.login_success',
  'auth.login_failed',
  'auth.logout',
  'auth.password_reset_requested',
  'auth.password_reset_completed',
  'auth.2fa_enabled',
  'auth.2fa_disabled',
  'auth.2fa_backup_code_used',
  // Integration
  'webhook.delivered',
  'webhook.failed',
  'payment_gateway.configured',
  'payment_gateway.removed',
  'smtp.configured',
  'smtp.verified',
  // Bulk
  'import.completed',
  'bulk.status_changed',
  // API Keys
  'api_key.created',
  'api_key.revoked',
  'api_key.used_from_new_ip',
] as const

export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number]

export const AUDIT_EVENT_GROUPS: Record<string, AuditEventGroup> = {
  'user.invited': 'User',
  'user.role_changed': 'User',
  'user.removed': 'User',
  'user.2fa_enforced': 'User',
  'user.frozen': 'User',
  'user.unfrozen': 'User',
  'customer.created': 'Data',
  'customer.updated': 'Data',
  'customer.deleted': 'Data',
  'invoice.created': 'Data',
  'invoice.updated': 'Data',
  'invoice.status_changed': 'Data',
  'invoice.sent': 'Data',
  'invoice.paid': 'Data',
  'invoice.voided': 'Data',
  'project.created': 'Data',
  'project.updated': 'Data',
  'project.deleted': 'Data',
  'expense.created': 'Data',
  'expense.updated': 'Data',
  'expense.deleted': 'Data',
  'contract.signed': 'Data',
  'contract.voided': 'Data',
  'settings.updated': 'Settings',
  'auth.login_success': 'Auth',
  'auth.login_failed': 'Auth',
  'auth.logout': 'Auth',
  'auth.password_reset_requested': 'Auth',
  'auth.password_reset_completed': 'Auth',
  'auth.2fa_enabled': 'Auth',
  'auth.2fa_disabled': 'Auth',
  'auth.2fa_backup_code_used': 'Auth',
  'webhook.delivered': 'Integration',
  'webhook.failed': 'Integration',
  'payment_gateway.configured': 'Integration',
  'payment_gateway.removed': 'Integration',
  'smtp.configured': 'Integration',
  'smtp.verified': 'Integration',
  'import.completed': 'Bulk',
  'bulk.status_changed': 'Bulk',
  'api_key.created': 'API Keys',
  'api_key.revoked': 'API Keys',
  'api_key.used_from_new_ip': 'API Keys',
}