const test = require('node:test');
const assert = require('node:assert/strict');

require('../src/common');

const { recordRequestAuditEvent } = require('../src/data/audit-log');

function createPool(settings) {
  const inserts = [];
  return {
    inserts,
    async query(sql, params) {
      if (String(sql).includes('SELECT id, setting_key, setting_value FROM o_app_settings')) {
        return [[
          { setting_key: 'audit.enabled', setting_value: JSON.stringify(settings.enabled) },
          { setting_key: 'audit.categories', setting_value: JSON.stringify(settings.categories) },
          { setting_key: 'audit.include_request_metadata', setting_value: JSON.stringify(settings.includeMetadata) }
        ]];
      }
      if (String(sql).includes('INSERT INTO o_audit_events')) {
        inserts.push(params);
      }
      return [[]];
    }
  };
}

const request = {
  ip: '192.0.2.10',
  headers: {
    'user-agent': 'audit-test'
  }
};

test('audit writer skips disabled categories', async () => {
  const pool = createPool({ enabled: true, categories: ['security'], includeMetadata: true });
  await recordRequestAuditEvent(pool, request, { category: 'authentication', eventType: 'login.success' });
  assert.equal(pool.inserts.length, 0);
});

test('audit writer omits request metadata when disabled', async () => {
  const pool = createPool({ enabled: true, categories: ['authentication'], includeMetadata: false });
  await recordRequestAuditEvent(pool, request, { category: 'authentication', eventType: 'login.success' });
  assert.equal(pool.inserts.length, 1);
  assert.equal(pool.inserts[0][6], null);
  assert.equal(pool.inserts[0][7], null);
});