<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use Illuminate\Http\Request;
use Illuminate\Routing\Controllers\HasMiddleware;
use Illuminate\Routing\Controllers\Middleware;
use Laravel\Passport\Http\Middleware\CheckToken;
use OpenApi\Attributes as OA;

class AuditLogController extends Controller implements HasMiddleware
{
    public static function middleware(): array
    {
        return [new Middleware(CheckToken::using('users:read'))];
    }

    #[OA\Get(
        path: '/audit-log',
        summary: 'Historial de auditoría: altas/bajas de usuarios, cambios de rol y de clientes OAuth',
        description: 'Requiere el permiso audit.view (o un token client_credentials, que actúa como servicio de confianza).',
        security: [['oauth2' => ['users:read']]],
        tags: ['Audit'],
        parameters: [
            new OA\Parameter(name: 'action', in: 'query', required: false, description: 'Filtrar por acción exacta (ej. user.updated)', schema: new OA\Schema(type: 'string')),
            new OA\Parameter(name: 'subject_type', in: 'query', required: false, description: 'user | client', schema: new OA\Schema(type: 'string')),
            new OA\Parameter(name: 'per_page', in: 'query', required: false, description: '5-100, default 25', schema: new OA\Schema(type: 'integer')),
        ],
        responses: [
            new OA\Response(response: 200, description: 'Listado paginado'),
            new OA\Response(response: 403, description: 'Sin permiso audit.view'),
        ]
    )]
    public function index(Request $request)
    {
        $actor = $request->user('api');
        abort_if($actor && ! $actor->can('audit.view'), 403);

        return response()->json(AuditLog::paginatedFor($request));
    }
}