/**
 * Public actions for audit logs.
 *
 * These are user-facing action endpoints with proper auth checks.
 */

import { v } from 'convex/values';

import { internal } from '../_generated/api';
import { action } from '../_generated/server';
import { buildDownloadUrl } from '../lib/helpers/public_storage_url';
import { getAuthUserIdentity } from '../lib/rls/auth/get_auth_user_identity';

export const requestExport = action({
  args: {
    organizationId: v.string(),
    format: v.union(v.literal('csv'), v.literal('json')),
    filter: v.optional(
      v.object({
        category: v.optional(v.string()),
        actorId: v.optional(v.string()),
        resourceType: v.optional(v.string()),
        status: v.optional(v.string()),
        startDate: v.optional(v.number()),
        endDate: v.optional(v.number()),
        search: v.optional(v.string()),
      }),
    ),
  },
  returns: v.object({
    storageId: v.string(),
    fileName: v.string(),
    url: v.string(),
  }),
  handler: async (
    ctx,
    args,
  ): Promise<{ storageId: string; fileName: string; url: string }> => {
    const authUser = await getAuthUserIdentity(ctx);
    if (!authUser) {
      throw new Error('Unauthenticated');
    }

    // Admin-only: verify membership and role via internal query
    const member = await ctx.runQuery(
      internal.audit_logs.internal_queries.verifyAdminAccess,
      {
        organizationId: args.organizationId,
        userId: authUser.userId,
        email: authUser.email,
        name: authUser.name,
      },
    );

    if (!member) {
      throw new Error('Only admins can export audit logs');
    }

    const result: { storageId: string; fileName: string } = await ctx.runAction(
      internal.audit_logs.export_audit_logs.exportAuditLogs,
      {
        organizationId: args.organizationId,
        format: args.format,
        filter: args.filter,
      },
    );

    const url = buildDownloadUrl(result.storageId, result.fileName);

    return {
      storageId: result.storageId,
      fileName: result.fileName,
      url,
    };
  },
});
