import { Navigate, Outlet } from 'react-router-dom';
import { useAuth } from '@/contexts/useAuth';
import { APP_ROUTE_PATHS } from '@/shared/constants/routes';

/**
 * Gate for the authenticated app shell (Workstream 3 §3.6). Once the session has
 * resolved, an unauthenticated visitor is redirected to `/login`; only the
 * public routes (`/login`, the error page) are reachable without a session.
 * While the session is still loading, the shell (`AppLayout`) renders its own
 * loader, so this guard renders the outlet and only redirects after resolution.
 */
export function AuthGuard() {
  const { isAuthenticated, loading } = useAuth();

  if (!loading && !isAuthenticated) {
    return <Navigate to={APP_ROUTE_PATHS.login} replace />;
  }

  return <Outlet />;
}
