// server/supabase/functions/_shared/audit.ts
// 감사로그 기록 유틸리티

// @ts-expect-error — Deno 런타임 import
import type { SupabaseClient } from 'https://esm.sh/@supabase/supabase-js@2.39.7'

export interface AuditLogEntry {
  adminId: string
  action: string        // 'subscription.create', 'subscription.update', 'subscription.delete', 'user.role_change'
  targetType: string    // 'subscription', 'profile'
  targetId: string
  beforeData: Record<string, unknown> | null
  afterData: Record<string, unknown> | null
  memo: string
}

/**
 * audit_log 테이블에 감사 기록을 삽입한다.
 * service_role 클라이언트를 사용해야 RLS를 우회한다.
 */
export async function writeAuditLog(
  supabase: SupabaseClient,
  entry: AuditLogEntry
): Promise<void> {
  const { error } = await supabase.from('audit_log').insert({
    admin_id: entry.adminId,
    action: entry.action,
    target_type: entry.targetType,
    target_id: entry.targetId,
    before_data: entry.beforeData,
    after_data: entry.afterData,
    memo: entry.memo,
  })
  if (error) {
    throw new Error(`Failed to write audit log: ${error.message}`)
  }
}