// Export Aiden audit events to a local NDJSON file.
//
// Documented at https://appcd-dev.github.io/stackgen-sdk/code-samples/audit-export/
//
//	go run ./examples/go/automation/audit-export.go --days 7 --output audit.ndjson
package main

import (
	"context"
	"flag"
	"fmt"
	"os"
	"strings"
	"time"

	stackgen "github.com/appcd-dev/stackgen-sdk/clients/go"
	"github.com/appcd-dev/stackgen-sdk/clients/go/aiden"
)

// envOr returns the first non-empty environment variable among keys.
func envOr(keys ...string) string {
	for _, key := range keys {
		if v := strings.TrimSpace(os.Getenv(key)); v != "" {
			return v
		}
	}
	return ""
}

func main() {
	days := flag.Int("days", 7, "how many days back to export")
	output := flag.String("output", "audit.ndjson", "local NDJSON path")
	eventType := flag.String("event-type", "", "optional event_type filter")
	format := flag.String("format", "native", "native or ocsf")
	maxEvents := flag.Int("max-events", 0, "optional cap for a dry run (0 means no cap)")
	flag.Parse()
	if *days < 1 {
		fmt.Fprintln(os.Stderr, "--days must be >= 1")
		os.Exit(2)
	}
	if *format != "native" && *format != "ocsf" {
		fmt.Fprintln(os.Stderr, "--format must be native or ocsf")
		os.Exit(2)
	}
	base, token, org := envOr("STACKGEN_URL"), envOr("STACKGEN_TOKEN"), envOr("STACKGEN_WORKSPACE_ID", "STACKGEN_PROJECT")
	if base == "" || token == "" || org == "" {
		fmt.Fprintln(os.Stderr, "set STACKGEN_URL, STACKGEN_TOKEN, and STACKGEN_WORKSPACE_ID")
		os.Exit(2)
	}
	client, err := stackgen.NewClient(stackgen.Config{BaseURL: base, APIToken: token, WorkspaceID: org})
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		os.Exit(1)
	}
	now := time.Now().UTC()
	start := now.AddDate(0, 0, -*days)
	result, err := client.Aiden.ExportAuditEvents(context.Background(), *output, aiden.AuditQuery{
		EventType: *eventType,
		From:      start.Format("2006-01-02T15:04:05Z"),
		To:        now.Format("2006-01-02T15:04:05Z"),
		Format:    *format,
		MaxEvents: *maxEvents,
	})
	if err != nil {
		fmt.Fprintln(os.Stderr, "error:", err)
		os.Exit(1)
	}
	fmt.Printf("wrote %d events to %s\n", result.Count, result.OutputPath)
}