// Package audit records who did what. Every issuance, link, relink and sign-in
// attempt lands here.
package audit

import (
	"context"
	"log"
	"time"

	"gitea.hostxtra.co.uk/mrhid6/vantage/admin/internal/db"
	"gitea.hostxtra.co.uk/mrhid6/vantage/admin/internal/models"
)

// Write never returns an error: an audit failure must not roll back the action
// it describes. It logs instead, loudly enough to notice.
func Write(ctx context.Context, e models.AuditEntry) {
	e.CreatedAt = time.Now().UTC()
	if _, err := db.Admin("admin_audit").InsertOne(ctx, e); err != nil {
		log.Printf("AUDIT WRITE FAILED action=%s target=%s: %v", e.Action, e.Target, err)
	}
}
