Audit logging

// AuditLog represents a stored audit log entry
type AuditLog struct {
    ID         string        `bson:"_id" json:"id"`
    TenantID   string        `bson:"tenant_id" json:"tenant_id"`
    UserID     string        `bson:"user_id" json:"user_id"`
    UserRoles  []string      `bson:"user_roles" json:"user_roles"`
    Action     string        `bson:"action" json:"action"`
    Collection string        `bson:"collection" json:"collection"`
    DocID      string        `bson:"doc_id" json:"doc_id"`
    DocVersion int           `bson:"doc_version" json:"doc_version"`
    Changes    []FieldChange `bson:"changes,omitempty" json:"changes,omitempty"`
    RequestID  string        `bson:"request_id" json:"request_id"`
    IPAddress  string        `bson:"ip_address" json:"ip_address"`
    UserAgent  string        `bson:"user_agent" json:"user_agent"`
    Timestamp  time.Time     `bson:"timestamp" json:"timestamp"`
    LatencyMs  int64         `bson:"latency_ms" json:"latency_ms"`
    Success    bool          `bson:"success" json:"success"`
    Error      string        `bson:"error,omitempty" json:"error,omitempty"`
}

// Log logs an audit event (non-blocking)
func (l *Logger) Log(ctx context.Context, event *AuditEvent) error {
    if event == nil {
        return ErrInvalidEvent
    }

    auditLog := l.eventToLog(event)

    // Store in MongoDB if enabled (async, non-blocking)
    if l.config.Storage.MongoDB.Enabled {
        select {
        case l.logChan <- auditLog:
            // Successfully queued
            metrics.AuditLogsTotal.WithLabelValues(event.Action, "true").Inc()
            metrics.AuditQueueSize.Set(float64(len(l.logChan)))
        default:
            // Channel full, increment dropped counter
            atomic.AddInt64(&l.droppedLogs, 1)
            metrics.AuditLogsDropped.Inc()
            metrics.AuditLogsTotal.WithLabelValues(event.Action, "false").Inc()
        }
    }

    // Add to webhook buffer if enabled
    if l.config.Storage.Webhook.Enabled {
        l.buffer.Add(auditLog)
        if l.buffer.Len() >= l.config.Storage.Webhook.BatchSize {
            go l.flushWebhook(context.Background())
        }
    }

    return nil
}

// mongoWorker reads from logChan in batches and flushes to MongoDB
func (l *Logger) mongoWorker() {
    defer l.mongoWg.Done()

    batch := make([]AuditLog, 0, DefaultBatchSize)
    ticker := time.NewTicker(DefaultFlushInterval)
    defer ticker.Stop()

    for {
        select {
        case logEntry, ok := <-l.logChan:
            if !ok {
                // Channel closed, flush remaining logs and exit
                if len(batch) > 0 {
                    l.flushMongoBatch(batch)
                }
                return
            }

            batch = append(batch, logEntry)

            // Flush when batch is full
            if len(batch) >= DefaultBatchSize {
                l.flushMongoBatch(batch)
                batch = make([]AuditLog, 0, DefaultBatchSize)
            }

        case <-ticker.C:
            // Flush on timer if there are any logs
            if len(batch) > 0 {
                l.flushMongoBatch(batch)
                batch = make([]AuditLog, 0, DefaultBatchSize)
            }
        }
    }
}

// GetLogs retrieves audit logs matching the filter
func (l *Logger) GetLogs(ctx context.Context, filter *AuditFilter, opts *QueryOpts) ([]*AuditLog, error) {
    collection := l.config.Storage.MongoDB.Collection
    if collection == "" {
        collection = "_pm_audit"
    }

    bsonFilter := l.buildFilter(filter)

    findOpts := &store.FindOptions{
        Sort: bson.D{{Key: "timestamp", Value: -1}},
    }

    if opts != nil {
        if opts.Limit > 0 {
            findOpts.Limit = opts.Limit
        }
        if opts.Skip > 0 {
            findOpts.Skip = opts.Skip
        }
    }

    docs, err := l.store.Find(ctx, collection, bsonFilter, findOpts)
    if err != nil {
        return nil, fmt.Errorf("failed to query audit logs: %w", err)
    }

    return l.docsToLogs(docs), nil
}

// GetLogsByDocument retrieves audit logs for a specific document
func (l *Logger) GetLogsByDocument(ctx context.Context, collectionName, docID string) ([]*AuditLog, error) {
    return l.GetLogs(ctx, &AuditFilter{
        Collection: collectionName,
        DocID:      docID,
    }, &QueryOpts{
        SortBy:  "timestamp",
        SortAsc: false,
    })
}

// GetLogsByUser retrieves audit logs for a specific user
func (l *Logger) GetLogsByUser(ctx context.Context, tenantID, userID string) ([]*AuditLog, error) {
    return l.GetLogs(ctx, &AuditFilter{
        TenantID: tenantID,
        UserID:   userID,
    }, &QueryOpts{
        SortBy:  "timestamp",
        SortAsc: false,
    })
}

// EnsureIndexes creates required indexes on the audit collection
func (l *Logger) EnsureIndexes(ctx context.Context) error {
    collection := l.config.Storage.MongoDB.Collection
    if collection == "" {
        collection = "_pm_audit"
    }

    ttlDays := l.config.Storage.MongoDB.TTLDays
    if ttlDays <= 0 {
        ttlDays = 90
    }
    ttl := time.Duration(ttlDays) * 24 * time.Hour

    indexes := []store.IndexConfig{
        // TTL index for automatic cleanup
        {
            Fields: []string{"timestamp"},
            Order:  []int{1},
            TTL:    &ttl,
            Name:   "timestamp_ttl",
        },
        // Compound index for tenant + user queries
        {
            Fields: []string{"tenant_id", "user_id"},
            Order:  []int{1, 1},
            Name:   "tenant_user",
        },
        // Compound index for document queries
        {
            Fields: []string{"collection", "doc_id"},
            Order:  []int{1, 1},
            Name:   "collection_doc",
        },
    }

    return l.store.EnsureIndexes(ctx, collection, indexes)
}