'use strict';
const { db } = require('../db');

const insert = db.prepare(
  `INSERT INTO logs (actor, actor_id, action, page, detail, ip)
   VALUES (@actor, @actor_id, @action, @page, @detail, @ip)`
);

/**
 * Record an auditable action.
 * @param {object} req  Express request (for user + ip). Can be null for system events.
 * @param {string} action  Short machine code, e.g. FILE_UPLOAD
 * @param {string} page  Human page name
 * @param {string} detail  Free-text description
 */
function log(req, action, page, detail) {
  const user = req && req.session && req.session.user;
  insert.run({
    actor: user ? user.username : 'system',
    actor_id: user ? user.id : null,
    action,
    page: page || null,
    detail: detail || null,
    ip: req ? (req.headers['x-forwarded-for'] || req.socket.remoteAddress || null) : null,
  });
}

module.exports = { log };