"""Audit log query endpoint.

Admin-only: the log is security telemetry (who did what, from which IP,
including every administrator's activity) and has no business being readable
by an account with the ``user`` role.
"""
from __future__ import annotations

from typing import Optional

from fastapi import APIRouter, Depends, Query
from sqlmodel import Session, select

from auth import require_admin
from database import get_session
from models.audit import AuditLog
from models.user import User

router = APIRouter(prefix="/api/audit", tags=["audit"])


@router.get("")
def list_audit(
    limit: int = Query(100, le=500),
    offset: int = 0,
    stack_id: Optional[str] = None,
    session: Session = Depends(get_session),
    _admin: User = Depends(require_admin),
) -> list[AuditLog]:
    stmt = select(AuditLog).order_by(AuditLog.timestamp.desc())
    if stack_id:
        stmt = stmt.where(AuditLog.target == stack_id)
    stmt = stmt.offset(offset).limit(limit)
    return session.exec(stmt).all()