import { redirect } from "next/navigation";
import { AppShell } from "~/components/layout/AppShell.js";
import { MfaPromptBanner } from "~/components/security/MfaPromptBanner.js";
import { SessionGuard } from "~/components/security/SessionGuard.js";
import { auth } from "~/server/auth.js";

const MFA_PROMPT_ROLES = new Set(["ADMIN", "MANAGER"]);

export default async function AppLayout({ children }: { children: React.ReactNode }) {
  const session = await auth();

  if (!session?.user) {
    redirect("/auth/signin");
  }

  const sessionUser = session.user as { id?: string; email?: string; role?: string } | undefined;
  const userRole = sessionUser?.role ?? "USER";

  return (
    <AppShell userRole={userRole}>
      <SessionGuard />
      {MFA_PROMPT_ROLES.has(userRole) && <MfaPromptBanner />}
      {children}
    </AppShell>
  );
}
