import { useEffect } from "react";
import { useNavigate } from "react-router";

import { type SessionState, useSession } from "@/client/lib/auth-client";
import { signInPath } from "@/client/lib/navigation";
import { hasAdminRole } from "@/shared/role";

export const useRequireSession = (redirectTo: string): SessionState => {
  const navigate = useNavigate();
  const session = useSession();
  const userId = session.data?.user.id ?? null;

  useEffect(() => {
    if (!session.isPending && !userId) {
      navigate(signInPath(redirectTo), { replace: true });
    }
  }, [session.isPending, userId, navigate, redirectTo]);

  return session;
};

export const useRequireAdmin = (redirectTo: string): SessionState => {
  const navigate = useNavigate();
  const session = useSession();
  const userId = session.data?.user.id ?? null;
  const role = session.data?.user.role ?? null;

  useEffect(() => {
    if (session.isPending) return;
    // Distinguish unauthenticated from authenticated-but-non-admin so a
    // signed-out admin deep link round-trips through /sign-in?redirect=
    // and lands back on the original admin URL after sign-in. A blanket
    // /account redirect would lose the destination.
    if (!userId) {
      navigate(signInPath(redirectTo), { replace: true });
      return;
    }
    if (!hasAdminRole(role)) {
      navigate("/account", { replace: true });
    }
  }, [session.isPending, userId, role, navigate, redirectTo]);

  return session;
};