from .models import AuditLog


def _infer_company(user, explicit_company=None):
    if explicit_company is not None:
        return explicit_company
    if not user or not getattr(user, "is_authenticated", False) or getattr(user, "is_superuser", False):
        return None
    # Safe fallback: infer only when the user is unambiguously scoped to one
    # company. Multi-company actions should pass company explicitly.
    from apps.accounts.permissions import accessible_company_ids
    ids = accessible_company_ids(user)
    if len(ids) == 1:
        return ids[0]
    return None


def log_event(*, user=None, company=None, action, module, object_id="", object_repr="", old_values=None, new_values=None, reason="", request=None):
    ip = request.META.get("REMOTE_ADDR") if request else None
    ua = request.META.get("HTTP_USER_AGENT", "") if request else ""
    company_value = _infer_company(user, company)
    company_id = getattr(company_value, "pk", company_value)
    return AuditLog.objects.create(
        company_id=company_id,
        user=user,
        action=action,
        module=module,
        object_id=str(object_id or ""),
        object_repr=object_repr,
        old_values=old_values or {},
        new_values=new_values or {},
        reason=reason,
        ip_address=ip,
        user_agent=ua,
    )