# orca-log.sh — structured slog-compatible JSON logging for bash scripts (C-17).
# Source this library from any orca bash script: `source scripts/lib/orca-log.sh`.
# Emits JSON to syslog via `logger`; falls back to stderr if `logger` is missing.
# Field set matches the Go audit log (REQ-006): ts, level, actor, action, resource, result, error.

ORCA_LOG_ACTOR="${ORCA_LOG_ACTOR:-spiffe://orca/cli/operator}"

# _orca_log_emit <level> <action> <resource> <result> [error]
_orca_log_emit() {
	local level="$1" action="$2" resource="$3" result="$4" error="${5:-}"
	local ts
	ts="$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)"
	# Build JSON with proper escaping of error field (escape backslash and quote).
	local err_json=""
	if [ -n "$error" ]; then
		local esc_error
		esc_error="${error//\\/\\\\}"
		esc_error="${esc_error//\"/\\\"}"
		err_json=",\"error\":\"$esc_error\""
	fi
	local line
	line="{\"ts\":\"$ts\",\"level\":\"$level\",\"actor\":\"$ORCA_LOG_ACTOR\",\"action\":\"$action\",\"resource\":\"$resource\",\"result\":\"$result\"$err_json}"
	if command -v logger >/dev/null 2>&1; then
		logger -t orca "$line"
	else
		echo "$line" >&2
	fi
}

orca_log_info()  { _orca_log_emit "info"  "$1" "$2" "$3" "${4:-}"; }
orca_log_warn()  { _orca_log_emit "warn"  "$1" "$2" "$3" "${4:-}"; }
orca_log_error() { _orca_log_emit "error" "$1" "$2" "$3" "${4:-}"; }