"""DMS audit bounded context — service layer (write-once records)."""

from __future__ import annotations

from typing import Any, Optional

from simorgh.apps.dms.audit.models import (
    AccessLog,
    AccessType,
    DocumentAction,
    DocumentAuditLog,
    SecurityEvent,
    SecurityEventSeverity,
    SecurityEventType,
)


# ---------------------------------------------------------------------------
# DocumentAuditLog
# ---------------------------------------------------------------------------

def log_document_action(
    *,
    tenant_id: int,
    document_id: int,
    action: str,
    actor: Optional[Any] = None,
    organization_node_id: Optional[int] = None,
    version_ref_id: Optional[int] = None,
    before_state: Optional[dict] = None,
    after_state: Optional[dict] = None,
    metadata: Optional[dict] = None,
    ip_address: Optional[str] = None,
    user_agent: str = "",
) -> DocumentAuditLog:
    """Create an immutable DocumentAuditLog entry."""
    return DocumentAuditLog.objects.create(
        tenant_id=tenant_id,
        organization_node_id=organization_node_id,
        document_id=document_id,
        action=action,
        actor=actor,
        version_ref_id=version_ref_id,
        before_state=before_state or {},
        after_state=after_state or {},
        metadata=metadata or {},
        ip_address=ip_address,
        user_agent=user_agent,
    )


# ---------------------------------------------------------------------------
# AccessLog
# ---------------------------------------------------------------------------

def log_access(
    *,
    tenant_id: int,
    document_id: int,
    access_type: str,
    actor: Optional[Any] = None,
    organization_node_id: Optional[int] = None,
    version_ref_id: Optional[int] = None,
    ip_address: Optional[str] = None,
    user_agent: str = "",
    metadata: Optional[dict] = None,
) -> AccessLog:
    """Create an immutable AccessLog entry."""
    return AccessLog.objects.create(
        tenant_id=tenant_id,
        organization_node_id=organization_node_id,
        document_id=document_id,
        access_type=access_type,
        actor=actor,
        version_ref_id=version_ref_id,
        ip_address=ip_address,
        user_agent=user_agent,
        metadata=metadata or {},
    )


# ---------------------------------------------------------------------------
# SecurityEvent
# ---------------------------------------------------------------------------

def log_security_event(
    *,
    tenant_id: int,
    event_type: str,
    severity: str = SecurityEventSeverity.WARNING,
    document_id: Optional[int] = None,
    actor: Optional[Any] = None,
    description: str = "",
    ip_address: Optional[str] = None,
    metadata: Optional[dict] = None,
) -> SecurityEvent:
    """Create an immutable SecurityEvent."""
    return SecurityEvent.objects.create(
        tenant_id=tenant_id,
        event_type=event_type,
        severity=severity,
        document_id=document_id,
        actor=actor,
        description=description,
        ip_address=ip_address,
        metadata=metadata or {},
    )