"use client";

import { useEffect } from "react";
import { usePathname, useRouter } from "@/i18n/routing";
import { getRoutePolicy } from "@/lib/rbac/route-policies";
import { usePermissions } from "@/hooks/use-permissions";
import { useUserStore } from "@/store/userStore";

export function RouteGuard() {
  const pathname = usePathname();
  const router = useRouter();
  const { ready, canKey } = usePermissions();
  // Only enforce once permissions have been refreshed from /auth/me this
  // session — avoids redirecting against a stale/empty set during hydration.
  const accessValidated = useUserStore((state) => state.accessValidated);

  useEffect(() => {
    if (!ready || !accessValidated || !pathname) {
      return;
    }

    // Never bounce off the 403 page itself (avoids redirect loops).
    if (pathname.replace(/^\/(ar|en)(?=\/|$)/, "").startsWith("/dashboard/403")) {
      return;
    }

    const policy = getRoutePolicy(pathname);
    if (!policy) {
      return;
    }

    if (!canKey(policy.permission)) {
      router.replace("/dashboard/403");
    }
  }, [ready, accessValidated, pathname, canKey, router]);

  return null;
}