import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/admin/db";
import { requireMainAdmin } from "@/lib/admin/auth";

export const dynamic = "force-dynamic";

export async function GET(req: NextRequest) {
  try {
    // Strictly Main Admin only. Returns 403 Forbidden to any Sub-Admin.
    await requireMainAdmin(req);

    const { searchParams } = new URL(req.url);
    const action = searchParams.get("action") || undefined;
    const actorId = searchParams.get("actorId") || undefined;
    const targetUserId = searchParams.get("targetUserId") || undefined;
    const search = searchParams.get("search") || undefined;
    const limitParam = searchParams.get("limit");
    const limit = limitParam ? parseInt(limitParam, 10) : 100;

    const logs = await db.getSecurityLogs({
      action,
      actorId,
      targetUserId,
      search,
      limit,
    });

    return NextResponse.json({ logs });
  } catch (error) {
    const status = (error as unknown as { status: number }).status || 500;
    return NextResponse.json(
      { error: (error as Error).message || "Access denied." },
      { status }
    );
  }
}