import { z } from 'zod';

export const AuditLogSchema = z.object({
  id: z.string(),
  // `shell-exec` covers privileged shell-outs (docker prune, container
  // restart, code-quality npm runs) so a leaked admin token's actions are
  // reconstructable from cosmos rather than only from container stdout.
  action: z.enum(['create', 'update', 'delete', 'deploy', 'trigger', 'shell-exec']),
  entityType: z.enum(['service', 'deployment', 'user', 'host']),
  entityId: z.string(),
  userId: z.string(),
  role: z.string(),
  timestamp: z.string(),
  details: z.record(z.any()).optional(),
  productId: z.string(),
});

export type AuditLog = z.infer<typeof AuditLogSchema>;

export const CreateAuditLogSchema = AuditLogSchema.partial({
  id: true,
  timestamp: true,
});

export type CreateAuditLog = z.infer<typeof CreateAuditLogSchema>;

export const QueryParamsSchema = z.object({
  limit: z.coerce.number().min(1).max(500).default(100),
});

export type QueryParams = z.infer<typeof QueryParamsSchema>;
