// Bot-scoring / IP-ban visibility for admins. Read-only view of the botScore
// middleware's in-memory state plus a recent-events feed, and a single mutating
// action — an emergency unban for false positives. Mounted behind the admin-only
// RBAC gate (see botActivity.router.js). This is visibility + emergency unban only;
// there is deliberately no way to add a ban or change scoring weights from here.

const botScore = require('../../../middleware/botScore')
const activity = require('../../../model/activity/activity.model')

const log = require('../../../utils/logger')('botactivity')

// Current store state (all scored IPs, banned or not) plus the recent-events
// buffer, most-recent-first. Both are in-memory and reset on process restart.
async function getBotActivity(req, res) {
  return res.json({
    ips: botScore.listState(),
    events: botScore.recentEvents(),
  })
}

// Emergency unban: clear a single IP's entry so it is no longer banned or
// carrying score. A real administrative action — logged with the admin user.
async function unbanIp(req, res) {
  const ip = req.body.ip
  const removed = botScore.unban(ip)
  await activity.log({ req, action: 'botscore.unban', detail: { ip, removed } })
  log.info('IP unbanned by admin', { ip, admin: req.user.username, removed })
  return res.json({ ip, removed })
}

module.exports = { getBotActivity, unbanIp }