"""Audit logging helpers for entity permission changes.

Extracted from entity_permission_service.py for modularity.
"""

from __future__ import annotations

import uuid

from sqlalchemy.ext.asyncio import AsyncSession

from app.core.audit import log_audit
from app.core.notifications import create_notification
from app.models.entity_permission import EntityPermission


async def _log_permission_grant(
    db: AsyncSession,
    tenant_id: uuid.UUID,
    created_by: uuid.UUID | None,
    perm: EntityPermission,
    permission_level: str,
    principal_type: str,
    principal_id: str,
) -> None:
    """Log audit entry for a new permission grant and notify the user."""
    await log_audit(
        db, tenant_id, created_by,
        action='permission_grant',
        entity_type='entity_permission',
        entity_id=perm.id,
        changes={'permission_level': permission_level, 'principal_type': principal_type, 'principal_id': principal_id}
    )
    # Notify user if direct permission
    if principal_type == 'user':
        await create_notification(
            db, tenant_id, uuid.UUID(principal_id),
            type='permission_granted',
            title='Neue Berechtigung',
            body=f'{perm.entity_type} wurde mit dir geteilt',
            entity_type=perm.entity_type,
            entity_id=perm.entity_id,
        )


async def _log_permission_update(
    db: AsyncSession,
    tenant_id: uuid.UUID,
    created_by: uuid.UUID | None,
    perm: EntityPermission,
    permission_level: str,
    principal_type: str,
    principal_id: str,
) -> None:
    """Log audit entry for a permission update and notify the user."""
    await log_audit(
        db, tenant_id, created_by,
        action='permission_update',
        entity_type='entity_permission',
        entity_id=perm.id,
        changes={'permission_level': permission_level, 'principal_type': principal_type, 'principal_id': principal_id}
    )
    # Notify user if direct permission
    if principal_type == 'user':
        await create_notification(
            db, tenant_id, uuid.UUID(principal_id),
            type='permission_granted',
            title='Neue Berechtigung',
            body=f'{perm.entity_type} wurde mit dir geteilt',
            entity_type=perm.entity_type,
            entity_id=perm.entity_id,
        )


async def _log_permission_revoke(
    db: AsyncSession,
    tenant_id: uuid.UUID,
    perm: EntityPermission,
) -> None:
    """Log audit entry for a permission revoke and notify the user."""
    await log_audit(
        db, tenant_id, None,
        action='permission_revoke',
        entity_type='entity_permission',
        entity_id=perm.id,
        changes={'permission_level': perm.permission_level, 'principal_type': perm.principal_type, 'principal_id': str(perm.principal_id)}
    )
    # Notify user if direct permission
    if perm.principal_type == 'user':
        await create_notification(
            db, tenant_id, perm.principal_id,
            type='permission_revoked',
            title='Berechtigung entfernt',
            body=f'{perm.entity_type} wurde nicht mehr mit dir geteilt',
            entity_type=perm.entity_type,
            entity_id=perm.entity_id,
        )