import { QnspClient } from "@cuilabs/qnsp";

const qnsp = new QnspClient({ apiKey: process.env.QNSP_API_KEY! });

// Check access via QNSP access-control-service
const allowed = await qnsp.access.check({
  principal: requesterId,
  resource: `record:${recordId}`,
  action: "read",
});

if (!allowed.granted) {
  await qnsp.audit.logEvent({
    eventType: "foia.access.denied",
    payload: { requesterId, recordId, reason: allowed.reason },
  });
  return { error: "ACCESS_DENIED" };
}

// Audit BEFORE returning record (regulator-grade evidence)
await qnsp.audit.logEvent({
  eventType: "foia.access.granted",
  payload: { requesterId, recordId, foiaRequestId },
});

const record = await qnsp.vault.getSecret(`record:${recordId}`);
return { payload: record.payloadB64 };