'use client';

import { useEffect } from 'react';
import { useRouter } from 'next/navigation';
import { useAuthStore } from '@/lib/stores/auth-store';

/**
 * PortalAuthGuard — client component that protects Client Portal routes.
 *
 * Only allows users with the 'Client_Portal' role to access portal pages.
 * - Unauthenticated users are redirected to /login.
 * - Authenticated users with a non-Client_Portal role are redirected to /overview.
 */
export default function PortalAuthGuard({ children }: { children: React.ReactNode }) {
  const router = useRouter();
  const { isAuthenticated, role } = useAuthStore();

  useEffect(() => {
    if (!isAuthenticated || !role) {
      router.replace('/login');
      return;
    }

    if (role !== 'Client_Portal') {
      router.replace('/overview');
    }
  }, [isAuthenticated, role, router]);

  // Don't render children until auth is confirmed valid
  if (!isAuthenticated || !role) {
    return null;
  }

  // Don't render portal for non-Client_Portal users
  if (role !== 'Client_Portal') {
    return null;
  }

  return <>{children}</>;
}