/**
 * Tracking interface for critical RBAC operations.
 *
 * This is a no-op stub that defines the contract for future analytics/audit
 * instrumentation. Replace the implementation with a real tracker (e.g.
 * PostHog, Mixpanel, or an internal event pipeline) when ready.
 */

/** The RBAC action being tracked. */
export type TrackPermissionAction =
  | "set_role_permissions"
  | "assign_user_roles"

/** Parameters for {@link trackPermissionChange}. */
export interface TrackPermissionChangeParams {
  /** The kind of RBAC operation. */
  action: TrackPermissionAction
  /** Role id involved in the change (set for `set_role_permissions`). */
  roleId?: string
  /** User id involved in the change (set for `assign_user_roles`). */
  userId?: string
  /** State before the change (permission values or role names). */
  before: string[]
  /** State after the change (permission values or role names). */
  after: string[]
}

/**
 * Track a permission/role change.
 *
 * Currently a no-op (console.debug only). The interface is stable so call
 * sites can be wired up without touching the actions layer again.
 */
export function trackPermissionChange(params: TrackPermissionChangeParams): void {
  // Reserved for future analytics implementation.
  // Intentionally minimal: avoid importing heavy SDKs until needed.
  if (process.env.NODE_ENV !== "production") {
    console.debug("[rbac:track]", params)
  }
}
