import { Router } from 'express';
import { auditController } from './audit.controller.js';
import { authenticate } from '../../shared/middleware/auth.middleware.js';
// import { requirePermission } from '../../shared/middleware/rbac.middleware.js'; // To implement later

const router = Router();

router.use(authenticate);

// List logs (add permission check later, e.g. 'audit.read')
router.get('/', (req, res, next) => auditController.getLogs(req, res, next));

// Entity logs
router.get('/:entityType/:entityId', (req, res, next) => auditController.getEntityLogs(req, res, next));

export default router;