from django.utils.deprecation import MiddlewareMixin
from .services.audit_service import log_event


class AuditMiddleware(MiddlewareMixin):
    """Log API access for authenticated users.

    Adds append-only audit entries for requests.
    """
    def process_response(self, request, response):
        try:
            user = request.user if hasattr(request, 'user') and request.user.is_authenticated else None
            if not user:
                return response

            metadata = {
                'path': request.path,
                'method': request.method,
                'status_code': getattr(response, 'status_code', None),
            }
            # Avoid logging health checks
            if request.path.endswith('/health/'):
                return response

            log_event(action='api_access', user=user, entity_type=None, entity_id=None, description=None, request=request, metadata=metadata)
        except Exception:
            # never raise from middleware
            pass
        return response