import { cookies, headers } from "next/headers"
import { redirect } from "next/navigation"

import { AuthProvider } from "@/app/providers/auth-provider"
import { DashboardShell } from "@/components/dashboard-shell"
import { normalizePath } from "@/lib/acl-routes"
import { getAccountServer } from "@/lib/auth/account-server"
import { canAccessRoute, getFirstAllowedHref } from "@/lib/auth/permissions"
import { AUTH_COOKIE_NAME } from "@/lib/api/constants"
import { routing } from "@/i18n/routing"

const LOCALES = routing.locales as readonly string[]

function pathFromHeaders(pathname: string): string {
  const segments = pathname.split("/").filter(Boolean)
  const first = segments[0]

  if (first && LOCALES.includes(first)) {
    const rest = segments.slice(1).join("/")
    return normalizePath(rest ? `/${rest}` : "/")
  }

  return normalizePath(pathname)
}

export default async function DashboardLayout({
  children,
  params,
}: {
  children: React.ReactNode
  params: Promise<{ locale: string }>
}) {
  const { locale } = await params
  const cookieStore = await cookies()
  const token = cookieStore.get(AUTH_COOKIE_NAME)?.value

  if (!token) {
    redirect(`/${locale}/login`)
  }

  let user
  try {
    user = await getAccountServer()
  } catch {
    redirect(`/${locale}/login`)
  }

  const headersList = await headers()
  const pathname = headersList.get("x-pathname") ?? ""
  const path = pathFromHeaders(pathname)

  if (path !== "/forbidden" && !canAccessRoute(user.permissionType, user.permissions, path)) {
    const fallback = getFirstAllowedHref(user.permissionType, user.permissions)

    if (path === "/dashboard" && fallback !== "/dashboard") {
      redirect(`/${locale}${fallback}`)
    }

    redirect(`/${locale}/forbidden`)
  }

  return (
    <AuthProvider user={user}>
      <DashboardShell>{children}</DashboardShell>
    </AuthProvider>
  )
}