using ERPCore.Dtos.Audit;
using ERPCore.Dtos.Common;
using ERPCore.Services.Interfaces;
using Microsoft.AspNetCore.Mvc;

namespace ERPCore.Controllers;

/// <summary>
/// Read-only audit trail (FR-X-02; auditor role). Extends the documented §11 API —
/// the audit trail is required (AR-01 compensating control) and read access is the
/// only way to consume it.
/// </summary>
[Route("api/v1/audit-logs")]
public sealed class AuditLogsController : ApiControllerBase
{
    private readonly IAuditService _audit;

    public AuditLogsController(IAuditService audit) => _audit = audit;

    [HttpGet]
    [ProducesResponseType(typeof(PagedResponse<AuditLogDto>), StatusCodes.Status200OK)]
    public async Task<ActionResult<PagedResponse<AuditLogDto>>> List(
        [FromQuery] string? entityType, [FromQuery] int? entityId, [FromQuery] int? userId,
        [FromQuery] DateOnly? from, [FromQuery] DateOnly? to, [FromQuery] PageQuery query, CancellationToken ct)
        => Ok(await _audit.ListLogsAsync(entityType, entityId, userId, from, to, query, ct));
}
