import { redirect } from "next/navigation";
import type { ReactNode } from "react";

import {
  EMPTY_CUSTOMER_PORTAL_CAPABILITIES,
  getCustomerSessionContext,
  type CustomerPortalCapabilities,
} from "@/lib/frontend-auth/server";
import { customerUrl } from "@/lib/tenant";

type LayoutProps = {
  children: ReactNode;
  params: Promise<{ tenant: string }>;
};

/** Portal admin: any admin capability from guest/me (Yii CorporateCapability). */
function hasAdminPortalAccess(
  capabilities: CustomerPortalCapabilities | undefined,
  routes: string[],
  user: { is_corporate_portal_actor?: boolean } | null,
): boolean {
  if (user?.is_corporate_portal_actor === false) {
    return false;
  }

  const caps = capabilities ?? EMPTY_CUSTOMER_PORTAL_CAPABILITIES;
  if (
    caps.admin_customers ||
    caps.admin_roles_view ||
    caps.admin_roles_manage ||
    caps.admin_users_view ||
    caps.admin_users_manage ||
    caps.admin_link_bank_view ||
    caps.admin_link_bank_manage
  ) {
    return true;
  }

  // Fallback for older sessions without capabilities payload.
  return routes.some((route) => route.startsWith("access/"));
}

export default async function AdminLayout({ children, params }: Readonly<LayoutProps>) {
  const { tenant } = await params;
  const session = await getCustomerSessionContext(tenant);

  if (
    !hasAdminPortalAccess(
      session.permissions.capabilities,
      session.permissions.routes,
      session.user,
    )
  ) {
    redirect(customerUrl(tenant, "/dashboard"));
  }

  return <>{children}</>;
}