<?php
declare(strict_types=1);

namespace App\Modules\Users\Services;

use App\Core\App;

final class PermissionAuditService
{
    public static function log(
        int $employeeId,
        string $action,
        string $targetType,
        string $targetValue,
        int $performedBy,
        ?string $notes = null
    ): void {
        try {
            App::getInstance()->db()->insert('permission_audit_log', [
                'employee_id'  => $employeeId,
                'action'       => $action,
                'target_type'  => $targetType,
                'target_value' => $targetValue,
                'performed_by' => $performedBy,
                'performed_at' => date('Y-m-d H:i:s'),
                'notes'        => $notes,
            ]);
        } catch (\Throwable $e) {
            // Non-critical — don't break the main operation
        }
    }

    public static function logRoleAssigned(int $employeeId, string $roleCode, int $performedBy): void
    {
        self::log($employeeId, 'role_assigned', 'role', $roleCode, $performedBy);
    }

    public static function logRoleRemoved(int $employeeId, string $roleCode, int $performedBy): void
    {
        self::log($employeeId, 'role_removed', 'role', $roleCode, $performedBy);
    }

    public static function logPermissionGranted(int $employeeId, string $permKey, int $performedBy): void
    {
        self::log($employeeId, 'perm_granted', 'permission', $permKey, $performedBy);
    }

    public static function logPermissionDenied(int $employeeId, string $permKey, int $performedBy): void
    {
        self::log($employeeId, 'perm_denied', 'permission', $permKey, $performedBy);
    }

    public static function logPermissionRemoved(int $employeeId, string $permKey, int $performedBy): void
    {
        self::log($employeeId, 'perm_removed', 'permission', $permKey, $performedBy);
    }

    public static function logBranchAdded(int $employeeId, int $branchId, int $performedBy): void
    {
        self::log($employeeId, 'branch_added', 'branch', (string) $branchId, $performedBy);
    }

    public static function logBranchRemoved(int $employeeId, int $branchId, int $performedBy): void
    {
        self::log($employeeId, 'branch_removed', 'branch', (string) $branchId, $performedBy);
    }

    public static function getHistory(int $employeeId, int $limit = 50): array
    {
        return App::getInstance()->db()->select(
            "SELECT pal.*, e.full_name_ar AS performer_name
             FROM permission_audit_log pal
             LEFT JOIN employees e ON e.id = pal.performed_by
             WHERE pal.employee_id = ?
             ORDER BY pal.performed_at DESC
             LIMIT ?",
            [$employeeId, $limit]
        );
    }

    public static function getActionLabel(string $action): string
    {
        return match ($action) {
            'role_assigned'  => 'تعيين دور',
            'role_removed'   => 'إزالة دور',
            'perm_granted'   => 'منح صلاحية',
            'perm_denied'    => 'رفض صلاحية',
            'perm_removed'   => 'إزالة صلاحية مباشرة',
            'branch_added'   => 'إضافة فرع',
            'branch_removed' => 'إزالة فرع',
            default          => $action,
        };
    }
}
