"""Minimal audit logging for critical auth actions (AP0.2)."""

from __future__ import annotations

import json
from typing import Any, Optional

from db import get_connection


def log_audit(
    action: str,
    *,
    user_id: Optional[str] = None,
    tenant_id: Optional[str] = None,
    details: Optional[dict[str, Any]] = None,
) -> None:
    conn = get_connection()
    try:
        with conn.cursor() as cur:
            cur.execute(
                """
                INSERT INTO audit_log (action, user_id, tenant_id, details)
                VALUES (%s, %s, %s, %s::jsonb)
                """,
                (action, user_id or None, tenant_id, json.dumps(details or {})),
            )
        conn.commit()
    finally:
        conn.close()