<?php

namespace App\Modules\Identity\Services;

use Illuminate\Support\Facades\DB;

final class Audit
{
    public static function record(string $action, ?int $actor, ?int $tenant = null, ?int $company = null, ?int $unit = null, ?int $subject = null, array $details = []): void
    {
        // Explicit allowlist: credentials, session/context tokens and request bodies never enter audit.
        $safe = array_intersect_key($details, array_flip(['before_name', 'after_name', 'permission', 'reason', 'operator', 'grants', 'area', 'record_id', 'version', 'event_id', 'module_id', 'previous_module_id']));
        DB::table('identity_audit')->insert([
            'action' => $action, 'actor_id' => $actor, 'tenant_id' => $tenant,
            'company_id' => $company, 'unit_id' => $unit, 'subject_id' => $subject,
            'details' => json_encode($safe, JSON_THROW_ON_ERROR), 'created_at' => now(),
        ]);
    }
}