<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;
use Illuminate\Database\Eloquent\Relations\BelongsTo;
use Illuminate\Support\Str;

class AuditEvent extends Model
{
    protected $guarded = [];

    protected $casts = ['meta' => 'array'];

    protected static function booted(): void
    {
        static::creating(fn (self $e) => $e->uuid ??= (string) Str::uuid());
    }

    public function getRouteKeyName(): string
    {
        return 'uuid';
    }

    public function user(): BelongsTo
    {
        return $this->belongsTo(User::class);
    }

    public function server(): BelongsTo
    {
        return $this->belongsTo(Server::class);
    }

    /** Actions that record a failure or security event — surfaced with a warning style. */
    private const ERROR_ACTIONS = [
        'auth.login_failed', 'auth.2fa_failed', 'auth.ip_banned',
        'fail2ban.ban', 'wg.action-failed',
    ];

    /**
     * Human-readable, localized label for the raw action code (e.g. "wg.set-endpoint" ->
     * "WireGuard-Endpoint geändert"). Falls back to a tidied form for unmapped/dynamic codes
     * (e.g. the dynamic "harden.*.on|off") so nothing ever shows a bare machine code awkwardly.
     */
    public function getActionLabelAttribute(): string
    {
        $labels = (array) trans('audit.actions');

        return $labels[$this->action] ?? $this->prettyAction();
    }

    /** True when the entry represents a failure / security alert (drives the warning styling). */
    public function getIsErrorAttribute(): bool
    {
        return in_array($this->action, self::ERROR_ACTIONS, true);
    }

    private function prettyAction(): string
    {
        $s = str_replace(['_', '-'], ' ', str_replace('.', ' · ', (string) $this->action));

        return Str::ucfirst(trim($s));
    }
}