import { requireAuth } from "@wrnexus/auth";
import { can } from "@wrnexus/authz";
import type { Middleware } from "@wrnexus/core";

const guard = requireAuth({ loginPath: "/login" });
const protectedPrefixes = ["/dashboard", "/contacts", "/deals", "/admin"];

const middleware: Middleware = (ctx, next) => {
  if (!protectedPrefixes.some((prefix) => ctx.url.pathname.startsWith(prefix))) return next();
  return guard(ctx, async () => {
    if (ctx.url.pathname.startsWith("/admin") && !(await can(ctx, "admin:access"))) {
      return Response.redirect(new URL("/forbidden", ctx.url), 303);
    }
    return next();
  });
};

export default middleware;