package gateway

import (
	"net/http"
	"time"

	"git.yeij.top/AskaEth/Cyrene_v2/internal/auth"
)

// auditClaims records an admin write with the caller identity read from the
// request context (populated by auth.Authorize). It is the who/what/when/result
// audit trail required for admin operations; the "主代理代审" user-facing note is
// the frontend's job, not the gateway's.
func (s *Server) auditClaims(r *http.Request, what, result string) {
	who := "anonymous"
	if claims, ok := auth.ClaimsFromContext(r.Context()); ok {
		who = claims.Sub + ":" + string(claims.Role)
	}
	s.audit(who, what, result)
}

// audit emits one structured audit record on the gateway logger.
func (s *Server) audit(who, what, result string) {
	s.log.Info("admin audit",
		"who", who,
		"what", what,
		"when", time.Now().UTC().Format(time.RFC3339),
		"result", result,
	)
}