'use strict';
// routes/audit.js — read-only Audit Trail viewer API. Access: full Admin and
// System Admin roles always; any other user must be granted the 'audit' module.
const express = require('express');
const router  = express.Router();
const { verifyToken } = require('../middleware/auth');
const store = require('../services/auditStore');

async function requireAuditView(req, res, next) {
  const u = req.user || {};
  if (u.role === 'admin' || u.role === 'system_admin') return next();
  // Module grant — read fresh from DB (JWT may not carry the modules list).
  try {
    const full = await require('../services/hanaUsers').findById(u.id);
    const mods = Array.isArray(full && full.modules) ? full.modules : [];
    if (mods.includes('audit')) return next();
  } catch (_e) {}
  return res.status(403).json({ success: false, message: 'You do not have access to the Audit Trail.' });
}

router.get('/', verifyToken, requireAuditView, async (req, res) => {
  try {
    const { data, total } = await store.list(req.query);
    res.json({ success: true, data, total });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

router.get('/facets', verifyToken, requireAuditView, async (req, res) => {
  try { res.json({ success: true, data: await store.facets() }); }
  catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

module.exports = router;