import { prisma } from '../prisma'

interface AuditEntry {
  userId: number
  action: string
  target: string
  targetId?: number
  before?: Record<string, unknown>
  after?: Record<string, unknown>
}

const SENSITIVE_KEY_RE =
  /password|secret|token|otp|recovery|authTicket|two_factor|two_factor_secret|api_key/i
const REDACTED = '[Redacted]'

function sanitizeAuditPayload(value: unknown, depth = 0): unknown {
  if (depth > 6 || value == null) return value
  if (Array.isArray(value)) return value.map((v) => sanitizeAuditPayload(v, depth + 1))
  if (typeof value !== 'object') return value

  const out: Record<string, unknown> = {}
  for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
    out[key] = SENSITIVE_KEY_RE.test(key) ? REDACTED : sanitizeAuditPayload(val, depth + 1)
  }
  return out
}

function computeDiff(
  before?: Record<string, unknown>,
  after?: Record<string, unknown>,
): Record<string, { from: unknown; to: unknown }> | null {
  if (!before || !after) return null

  const diff: Record<string, { from: unknown; to: unknown }> = {}
  const allKeys = new Set([...Object.keys(before), ...Object.keys(after)])

  for (const key of allKeys) {
    if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
      diff[key] = { from: before[key], to: after[key] }
    }
  }

  return Object.keys(diff).length > 0 ? diff : null
}

export async function logAudit(entry: AuditEntry): Promise<void> {
  const sanitizedBefore = entry.before
    ? (sanitizeAuditPayload(entry.before) as Record<string, unknown>)
    : undefined
  const sanitizedAfter = entry.after
    ? (sanitizeAuditPayload(entry.after) as Record<string, unknown>)
    : undefined
  const diff = computeDiff(sanitizedBefore, sanitizedAfter)

  await prisma.adminAuditLog.create({
    data: {
      userId: entry.userId,
      action: entry.action,
      target: entry.target,
      targetId: entry.targetId,
      before: sanitizedBefore ? JSON.stringify(sanitizedBefore) : null,
      after: sanitizedAfter ? JSON.stringify(sanitizedAfter) : null,
      diff: diff ? JSON.stringify(diff) : null,
      createdAt: new Date().toISOString(),
    },
  })
}

interface GetLogsOptions {
  search?: string
  page?: number
  perPage?: number
}

export async function getAuditLogs(options: GetLogsOptions = {}) {
  const { search, page = 1, perPage = 20 } = options
  const skip = (page - 1) * perPage

  const where = search
    ? {
        OR: [{ action: { contains: search } }, { target: { contains: search } }],
      }
    : {}

  const [rows, total] = await Promise.all([
    prisma.adminAuditLog.findMany({
      where,
      orderBy: { id: 'desc' },
      skip,
      take: perPage,
    }),
    prisma.adminAuditLog.count({ where }),
  ])

  const userIds = [...new Set(rows.map((r) => r.userId))]
  const users = await prisma.user.findMany({
    where: { id: { in: userIds } },
    select: { id: true, username: true },
  })
  const userMap = new Map(users.map((u) => [u.id, u.username]))

  const enrichedRows = rows.map((r) => ({
    ...r,
    username: userMap.get(r.userId) ?? `User #${r.userId}`,
  }))

  return {
    rows: enrichedRows,
    total,
    page,
    perPage,
    lastPage: Math.ceil(total / perPage),
  }
}