//! Audit log record types. One JSON object per line, hash-chained by the exact bytes of each line.

use serde::{Deserialize, Serialize};

use crate::{CallId, DataClass, DenyReason, Hash32, SessionId, Timestamp};

// JSON: {"outcome":"allowed","grant":"…"} ; the tag sits beside the fields; outcomes are snake_case
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "outcome", rename_all = "snake_case", deny_unknown_fields)]
pub enum DecisionRecord {
    Allowed {
        grant: String,
    },
    Approved {
        grant: String,
        approver: String,
        post: Option<String>,
    },
    Denied {
        reason: DenyReason,
        grant: Option<String>,
    },
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct AuditRecord {
    pub seq: u64,
    pub time: Timestamp,
    pub prev: Hash32,
    pub session: SessionId,
    pub call: CallId,
    pub tool: String,
    pub arguments: String,
    pub session_taint: DataClass,
    pub decision: DecisionRecord,
}