"use client";

import { useEffect } from "react";
import { usePathname, useRouter } from "next/navigation";
import { DEFAULT_UNAUTHENTICATED_ROUTE } from "@/lib/auth/constants";
import {
  canAccessRoute,
  getDefaultRouteForRole,
} from "@/lib/auth/permissions";
import { getAuthToken } from "@/lib/auth/token";
import { useAuth } from "./auth-provider";

export function RoleGuard({ children }: { children: React.ReactNode }) {
  const router = useRouter();
  const pathname = usePathname();
  const { isReady, role } = useAuth();

  useEffect(() => {
    if (!isReady) return;

    if (!getAuthToken()) {
      router.replace(DEFAULT_UNAUTHENTICATED_ROUTE);
      return;
    }

    if (role && !canAccessRoute(role, pathname)) {
      router.replace(getDefaultRouteForRole(role));
    }
  }, [isReady, pathname, role, router]);

  if (!isReady) {
    return <p className="text-m-regular text-neutral-80">Memuat...</p>;
  }

  if (!getAuthToken()) {
    return null;
  }

  if (role && !canAccessRoute(role, pathname)) {
    return null;
  }

  return children;
}