const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
const DEMO_WRITE_ALLOWLIST = new Set(["/api/auth/signin/local", "/api/auth/signin/demo", "/api/auth/logout"]);

function demoModeEnabled() {
  return process.env.DEMO_MODE === "true";
}

function enforceReadOnlyDemo(req, res, next) {
  if (!demoModeEnabled()) {
    next();
    return;
  }

  if (SAFE_METHODS.has(req.method) || DEMO_WRITE_ALLOWLIST.has(req.path)) {
    next();
    return;
  }

  res.status(403).send({
    error: "demo_read_only",
    message: "This public demo uses fictional data and does not save changes.",
  });
}

module.exports = {
  demoModeEnabled,
  enforceReadOnlyDemo,
};
