import type { PreUploadScanResult } from "@toolctrl/storage";
import { createAdminLog } from "~/utils/db/logs.db.server";

/**
 * Build an onReject callback for storeFile's scan option that writes an
 * "upload.rejected.scan" audit event with the verdict's bounded reason +
 * detail + detected MIME. Callers pass the route's incoming Request so the
 * audit row gets the right userId / url; never include the raw upload bytes
 * in the persisted detail.
 */
export function auditRejectedUpload(request: Request, context: string) {
  return async (verdict: PreUploadScanResult) => {
    const payload = {
      context,
      reason: verdict.reason ?? "unknown",
      detail: verdict.detail,
      detectedMimeType: verdict.detectedMimeType,
    };
    try {
      await createAdminLog(request, "upload.rejected.scan", JSON.stringify(payload));
    } catch {
      // audit write failures must never block the security signal
    }
  };
}