"use client"

import { useEffect, useState, type ReactNode } from "react"
import {
  ensureAuthConfig,
  getClaims,
  getToken,
  isAuthEnabled,
  redirectToPortalLogin,
  redirectToPortalLoginInteractive,
} from "@/lib/auth"

export function AuthGuard({ children }: { children: ReactNode }) {
  const [ready, setReady] = useState(false)

  useEffect(() => {
    let cancelled = false
    void (async () => {
      await ensureAuthConfig()
      if (cancelled) return
      if (!isAuthEnabled()) {
        setReady(true)
        return
      }
      const claims = getClaims()
      if (!getToken() || !claims) {
        const ok = redirectToPortalLogin()
        if (!ok) redirectToPortalLoginInteractive()
        return
      }
      if (!claims.apps.includes("mm")) {
        window.location.assign("/access-denied")
        return
      }
      setReady(true)
    })()
    return () => {
      cancelled = true
    }
  }, [])

  if (!ready) {
    return (
      <div className="text-muted-foreground flex min-h-svh items-center justify-center p-6 text-sm">
        Проверка сессии…
      </div>
    )
  }

  return children
}