Epicnabbo-Catalogus-Updated-Daily/src/lib/services/audit.ts

import { count, desc, inArray, like, or } from "drizzle-orm";
import { AdminAuditLog, db, User } from "@/lib/db";

interface AuditEntry {
	userId: number;
	action: string;
	target: string;
	targetId?: number;
	before?: Record<string, unknown>;
	after?: Record<string, unknown>;
}

const SENSITIVE_KEY_RE =
	/password|secret|token|otp|recovery|authTicket|two_factor|two_factor_secret|api_key/i;
const REDACTED = "[Redacted]";

function sanitizeAuditPayload(value: unknown, depth = 0): unknown {
	if (depth > 6 || value == null) return value;
	if (Array.isArray(value))
		return value.map((v) => sanitizeAuditPayload(v, depth + 1));
	if (typeof value !== "object") return value;

	const out: Record<string, unknown> = {};
	for (const [key, val] of Object.entries(value as Record<string, unknown>)) {
		out[key] = SENSITIVE_KEY_RE.test(key)
			? REDACTED
			: sanitizeAuditPayload(val, depth + 1);
	}
	return out;
}

function computeDiff(
	before?: Record<string, unknown>,
	after?: Record<string, unknown>,
): Record<string, { from: unknown; to: unknown }> | null {
	if (!before || !after) return null;

	const diff: Record<string, { from: unknown; to: unknown }> = {};
	const allKeys = new Set([...Object.keys(before), ...Object.keys(after)]);

	for (const key of allKeys) {
		if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
			diff[key] = { from: before[key], to: after[key] };
		}
	}

	return Object.keys(diff).length > 0 ? diff : null;
}

export async function logAudit(entry: AuditEntry): Promise<void> {
	const sanitizedBefore = entry.before
		? (sanitizeAuditPayload(entry.before) as Record<string, unknown>)
		: undefined;
	const sanitizedAfter = entry.after
		? (sanitizeAuditPayload(entry.after) as Record<string, unknown>)
		: undefined;
	const diff = computeDiff(sanitizedBefore, sanitizedAfter);

	await db.insert(AdminAuditLog).values({
		userId: entry.userId,
		action: entry.action,
		target: entry.target,
		targetId: entry.targetId,
		before: sanitizedBefore ? JSON.stringify(sanitizedBefore) : null,
		after: sanitizedAfter ? JSON.stringify(sanitizedAfter) : null,
		diff: diff ? JSON.stringify(diff) : null,
		createdAt: new Date().toISOString(),
	});
}

interface GetLogsOptions {
	search?: string;
	page?: number;
	perPage?: number;
}

export async function getAuditLogs(options: GetLogsOptions = {}) {
	const { search, page = 1, perPage = 20 } = options;
	const skip = (page - 1) * perPage;

	const where = search
		? or(
				like(AdminAuditLog.action, `%${search}%`),
				like(AdminAuditLog.target, `%${search}%`),
			)
		: undefined;

	const [rows, totalResult] = await Promise.all([
		db
			.select({
				id: AdminAuditLog.id,
				userId: AdminAuditLog.userId,
				action: AdminAuditLog.action,
				target: AdminAuditLog.target,
				targetId: AdminAuditLog.targetId,
				diff: AdminAuditLog.diff,
				createdAt: AdminAuditLog.createdAt,
			})
			.from(AdminAuditLog)
			.where(where)
			.orderBy(desc(AdminAuditLog.id))
			.limit(perPage)
			.offset(skip),
		db.select({ value: count() }).from(AdminAuditLog).where(where),
	]);

	const total = Number(totalResult[0]?.value ?? 0);

	const userIds = [...new Set(rows.map((r) => r.userId))];
	const users =
		userIds.length > 0
			? await db
					.select({ id: User.id, username: User.username })
					.from(User)
					.where(inArray(User.id, userIds))
			: [];
	const userMap = new Map(users.map((u) => [u.id, u.username]));

	const enrichedRows = rows.map((r) => ({
		...r,
		username: userMap.get(r.userId) ?? `User #${r.userId}`,
	}));

	return {
		rows: enrichedRows,
		total,
		page,
		perPage,
		lastPage: Math.ceil(total / perPage),
	};
}