import { useNavigate } from "@tanstack/react-router";
import { useEffect } from "react";
import { useSession } from "@/lib/auth-client";
import {
  isEmailVerificationBypassed,
  isHostedClientAuthMode,
  isSessionClientAuthMode,
} from "@/lib/auth-mode";
import {
  getCurrentAuthRedirectFromHref,
  getSignInSearch,
  getVerifyEmailSearch,
} from "@/lib/auth-redirect";

export function useHostedAuthRouteGuard() {
  const navigate = useNavigate();
  const { data: session, isPending } = useSession();
  // `hosted` and `team` both require a Better Auth session; only `hosted` has
  // an email-verification step (team has no transactional email).
  const isSessionMode = isSessionClientAuthMode();
  const isHostedMode = isHostedClientAuthMode();
  const emailVerified =
    !isHostedMode ||
    session?.user?.emailVerified === true ||
    isEmailVerificationBypassed();

  useEffect(() => {
    if (isPending || !isSessionMode) {
      return;
    }

    const redirectTo = getCurrentAuthRedirectFromHref(window.location.href);

    if (!session?.user?.id) {
      void navigate({
        to: "/sign-in",
        search: getSignInSearch(redirectTo),
        replace: true,
      });
      return;
    }

    if (!emailVerified) {
      void navigate({
        to: "/verify-email",
        search: getVerifyEmailSearch(session.user.email, redirectTo),
        replace: true,
      });
    }
  }, [
    isPending,
    isSessionMode,
    emailVerified,
    session?.user?.email,
    session?.user?.id,
    navigate,
  ]);

  const hasVerifiedHostedSession =
    !isPending && Boolean(session?.user?.id) && emailVerified;

  return {
    isHostedMode,
    isSessionMode,
    canRenderAuthenticatedContent: !isSessionMode || hasVerifiedHostedSession,
  };
}