/**
 * Audit Log routes for SentryAgent.ai AgentIdP.
 * All routes require Bearer auth, OPA authorization, and are rate-limited.
 */

import { Router, RequestHandler } from 'express';
import { AuditController } from '../controllers/AuditController.js';
import { authMiddleware } from '../middleware/auth.js';
import { rateLimitMiddleware } from '../middleware/rateLimit.js';
import { asyncHandler } from '../utils/asyncHandler.js';

/**
 * Creates and returns the Express router for audit log endpoints.
 *
 * @param auditController - The audit controller instance.
 * @param opaMiddleware - The OPA authorization middleware created at startup.
 * @returns Configured Express router.
 */
export function createAuditRouter(auditController: AuditController, opaMiddleware: RequestHandler): Router {
  const router = Router();

  router.use(asyncHandler(authMiddleware));
  router.use(opaMiddleware);
  router.use(asyncHandler(rateLimitMiddleware));

  // GET /audit — Query audit log
  router.get('/', asyncHandler(auditController.queryAuditLog.bind(auditController)));

  // GET /audit/:eventId — Get a single audit event
  router.get('/:eventId', asyncHandler(auditController.getAuditEventById.bind(auditController)));

  return router;
}
