<?php
defined( 'ABSPATH' ) || exit;

/**
 * Audit log writer — shared infrastructure used by both tiers.
 *
 * Free: records admin-toggle changes (enable/disable, notes).
 * Pro:  records the full certificate lifecycle (submission, approval,
 *       rejection, revocation, edit, expiry, warnings, retention purges).
 */
class Rankd_Tx_Audit {

	/**
	 * Inserts a row into the audit log table.
	 *
	 * @param int    $user_id   The customer user ID.
	 * @param int    $cert_id   Certificate ID (0 for toggle-only actions).
	 * @param string $action    Action slug.
	 * @param int    $actor_id  Admin user ID performing the action (0 = system/cron).
	 * @param string $note      Optional note.
	 */
	public static function log( $user_id, $cert_id, $action, $actor_id = 0, $note = '' ) {
		global $wpdb;

		$wpdb->insert( // phpcs:ignore WordPress.DB.DirectDatabaseQuery
			$wpdb->prefix . 'rankd_tx_audit_log',
			array(
				'user_id'    => absint( $user_id ),
				'cert_id'    => $cert_id ? absint( $cert_id ) : null,
				'action'     => sanitize_key( $action ),
				'actor_id'   => $actor_id ? absint( $actor_id ) : null,
				'note'       => sanitize_textarea_field( $note ),
				'created_at' => current_time( 'mysql', true ),
			),
			array( '%d', '%d', '%s', '%d', '%s', '%s' )
		);
	}
}
