import { Logger } from '@nestjs/common';
import type { NextFunction, Request, Response } from 'express';

const logger = new Logger('HTTP');

/**
 * One line per request in stdout/kubectl logs: method, path, status, and
 * timing - never the body/headers, so passwords and tokens never end up in
 * logs. Without this, a normal (non-error) request leaves zero trace,
 * which makes "did the request even arrive?" the hardest question to
 * answer when something looks broken from outside the cluster.
 */
export function requestLoggerMiddleware(
  req: Request,
  res: Response,
  next: NextFunction,
): void {
  const start = Date.now();
  res.on('finish', () => {
    const duration = Date.now() - start;
    // Path only: query strings can carry secrets (the SSO callback's
    // authorization code and state, search terms with personal data).
    const line = `${req.method} ${req.baseUrl}${req.path} ${res.statusCode} ${duration}ms`;
    if (res.statusCode >= 500) {
      logger.error(line);
    } else if (res.statusCode >= 400) {
      logger.warn(line);
    } else {
      logger.log(line);
    }
  });
  next();
}