import { redirect } from "next/navigation";
import type { ReactNode } from "react";

import { hasAnyAdminCapability } from "@/app/customer/_lib/admin/admin-portal-access";
import {
  getCustomerSessionContext,
  type CustomerPortalCapabilities,
} from "@/lib/frontend-auth/server";
import { customerUrl } from "@/lib/tenant";

type LayoutProps = {
  children: ReactNode;
  params: Promise<{ tenant: string }>;
};

/**
 * Portal admin: any admin capability from guest/me (Yii CorporateCapability).
 * Capabilities are the chrome SoT — do not fall back to route-prefix OR.
 */
function hasAdminPortalAccess(
  capabilities: CustomerPortalCapabilities | undefined,
  user: { is_corporate_portal_actor?: boolean } | null,
): boolean {
  if (user?.is_corporate_portal_actor === false) {
    return false;
  }

  return hasAnyAdminCapability(capabilities);
}

export default async function AdminLayout({ children, params }: Readonly<LayoutProps>) {
  const { tenant } = await params;
  const session = await getCustomerSessionContext(tenant);

  if (!hasAdminPortalAccess(session.permissions.capabilities, session.user)) {
    redirect(customerUrl(tenant, "/dashboard"));
  }

  return <>{children}</>;
}