"""Audit trail for changes made through MCP.

Every mutating tool records its change with `audit_mcp`, under the calling
user's id and the username "<user> via MCP" (an operator ruling on the API
Surface), so the audit log separates what a person did from what an agent
did on their token. The token id goes into the detail.
"""
from __future__ import annotations

from steward.core.audit import log_audit
from steward.mcp._context import current_caller, mcp_app

VIA = " via MCP"


def mcp_username(username: str) -> str:
    return (username + VIA)[:64]


async def audit_mcp(action: str, entity_type: str | None = None, entity_id: str | None = None,
                    detail: dict | None = None) -> None:
    caller = current_caller()
    await log_audit(mcp_app(), caller.user_id, mcp_username(caller.username), action,
                    entity_type, entity_id, {**(detail or {}), "token_id": caller.token_id})