import { route } from 'quasar/wrappers'
import { createRouter, createWebHashHistory } from 'vue-router'

import routes from 'src/router/routes.js'

import { useAuthStore } from 'stores/authStore'
import { usePermissionStore } from 'stores/permissionStore'
import { getAuthUserId } from 'src/modules/activityLogs'


export default route(function () {

  const router = createRouter({
    history: createWebHashHistory(),
    routes
  })

  if (typeof window !== 'undefined' && process.env.DEV) {
    window.__router = router
  }

  /* ============================================================
     🔐 GLOBAL GUARD
  ============================================================ */
  router.beforeEach(async (to, from, next) => {

    const auth = useAuthStore()
    const perm = usePermissionStore()

    if (typeof window !== 'undefined' && process.env.DEV) {
      window.__auth = auth
      window.__perm = perm
    }

    /* ================= PUBLIC ================= */

    if (to.meta?.public === true) {
      return next()
    }


    /* ================= LOGIN ================= */

    if (!auth.isAuthenticated) {
      return next('/login')
    }


    /* ================= PASSWORD ================= */

    if (
      auth.mustChangePassword &&
      to.path !== '/first-password-change'
    ) {
      return next('/first-password-change')
    }

    /* ================= USER ID RESTRICTIONS ================= */

    const onlyUserIds = to.meta?.onlyUserIds
    if (Array.isArray(onlyUserIds) && onlyUserIds.length > 0) {
      const id = getAuthUserId(auth.user)
      if (id == null || !onlyUserIds.includes(id)) {
        return next('/unauthorized')
      }
    }


    /* ================= ADMIN ================= */

    if (auth.isAdmin) {
      return next()
    }


    /* ================= LOAD PERMS ================= */

    if (!perm.loaded) {
      try {
        await perm.fetchPermissions()
      } catch (e) {
        console.error('Permission load failed', e)
      }
    }


    /* ================= CHECK ================= */

    const required = to.meta?.permission

    if (!required) {
      return next()
    }


    const allowed = perm.hasApiPermission(required)

    if (!allowed) {

      console.warn('⛔ ACCESS DENIED:', {
        path: to.fullPath,
        permission: required
      })

      return next('/unauthorized')
    }


    next()
  })


  return router
})
