import 'server-only'

import { createAdminClient } from '@/lib/supabase/admin'

/**
 * Security event log (2026-09-22): sign-ins, failures, lockouts, sign-outs,
 * role switches, admin password resets and role changes, MFA changes. The
 * evidence an auditor asks for ("who signed in, from where, when did the
 * lockout fire"). Append-only; tolerates migration 0026 not being applied.
 */
export type SecurityEvent =
  | 'login_success'
  | 'login_failed'
  | 'login_locked'
  | 'login_mfa_required'
  | 'login_mfa_failed'
  | 'signout'
  | 'role_switch'
  | 'admin_password_reset'
  | 'admin_role_change'
  | 'mfa_enrolled'
  | 'mfa_disabled'
  | 'mfa_reset_by_admin'
  | 'api_rate_limited'
  | 'account_email_change_requested'
  | 'account_email_changed'
  | 'account_phone_changed'
  | 'moderator_access_denied'

export async function logSecurityEvent(params: {
  event: SecurityEvent
  username?: string | null
  userId?: string | null
  actorUserId?: string | null
  actorLabel?: string | null
  ip?: string | null
  userAgent?: string | null
  detail?: Record<string, unknown> | null
}) {
  const admin = createAdminClient()
  const { error } = await admin.from('security_events').insert({
    event: params.event,
    username: params.username ?? null,
    user_id: params.userId ?? null,
    actor_user_id: params.actorUserId ?? null,
    actor_label: params.actorLabel ?? null,
    ip: params.ip ?? null,
    user_agent: params.userAgent?.slice(0, 300) ?? null,
    detail: params.detail ?? null,
  })
  if (error && !/does not exist|schema cache/i.test(error.message)) console.error('security_events insert failed', error.message)
}