using ZB.MOM.WW.ScadaBridge.Commons.Types;
using ZB.MOM.WW.ScadaBridge.Commons.Types.Audit;
namespace ZB.MOM.WW.ScadaBridge.CentralUI.Services;
///
/// CentralUI facade over
/// (#23 M7-T3). The Audit Log page's results grid talks to this service rather than
/// the repository directly so tests can substitute a fake without spinning up EF
/// Core, and so a future caching / shaping layer (e.g. server-side CSV streaming)
/// can hang off the same seam.
///
public interface IAuditLogQueryService
{
///
/// Returns a keyset-paged result page for . When
/// is null, defaults to
/// rows with no cursor (first page). The repository orders by
/// (OccurredAtUtc DESC, EventId DESC); pass the last row's
/// +
/// back as the cursor for the next page.
///
///
/// C3 (Task 2.5): the repository seam returns the canonical
/// ZB.MOM.WW.Audit.AuditEvent; this facade decomposes each row into a flat
/// so the audit pages keep binding to typed properties.
///
/// Filter criteria applied to the audit log query.
/// Optional paging cursor; defaults to first page when null.
/// Cancellation token.
Task> QueryAsync(
AuditLogQueryFilter filter,
AuditLogPaging? paging = null,
CancellationToken ct = default);
/// Default page size when callers don't specify one.
int DefaultPageSize { get; }
///
/// Audit Log (#23) M7 Bundle E (T13) — returns the point-in-time KPI snapshot
/// the Health dashboard's Audit tiles render. Composes:
///
/// - TotalEventsLastHour + ErrorEventsLastHour from
///
/// (1-hour trailing window).
/// - BacklogTotal from the sum of every site's
/// SiteHealthReport.SiteAuditBacklog.PendingCount via
/// .
///
///
///
/// Repository + aggregator are read independently; if either source has no
/// data the corresponding field is zero (a real signal — "no events" vs
/// "no backlog" — rather than an error). The service does NOT swallow
/// exceptions; the page wraps the call in a try/catch so a transient DB
/// outage degrades the tile group to "unavailable" rather than killing the
/// dashboard.
///
/// Cancellation token.
Task GetKpiSnapshotAsync(CancellationToken ct = default);
///
/// Audit Log ParentExecutionId feature (Task 10) — returns the full
/// execution chain containing as a flat list
/// of , delegating to
/// .
/// The execution-chain tree view (/audit/execution-tree) assembles the
/// returned flat list into a tree by joining
/// to a parent node's
/// .
///
///
/// A pure pass-through, mirroring — the production
/// implementation opens its own DI scope per call so the tree page's
/// auto-load never contends with the circuit-scoped ScadaBridgeDbContext.
///
/// Any execution id in the chain to look up.
/// Cancellation token.
Task> GetExecutionTreeAsync(
Guid executionId,
CancellationToken ct = default);
///
/// Returns the distinct, non-null SourceNode values present in the
/// central AuditLog table, backing the Audit Log page's Node
/// multi-select filter. The implementation caches the result for ~60s so
/// rendering the filter bar never produces more than one DB hit per minute
/// per circuit. The cache is process-wide — node membership changes
/// (failover, scaling) surface within a minute, which is acceptable for a
/// filter affordance.
///
/// Cancellation token.
Task> GetDistinctSourceNodesAsync(CancellationToken ct = default);
}