import { Navigate, useLocation } from 'react-router-dom';
import { useAuth } from '../../contexts/AuthContext';

interface ProtectedRouteProps {
  children: React.ReactNode;
  /** If true, requires staff role (dev or com). */
  staffOnly?: boolean;
  /** Redirect destination when access is denied. Defaults to /login. */
  redirectTo?: string;
}

export function ProtectedRoute({
  children,
  staffOnly = false,
  redirectTo = '/login',
}: ProtectedRouteProps) {
  const { isAuthenticated, isStaff } = useAuth();
  const location = useLocation();

  if (!isAuthenticated) {
    return <Navigate to={redirectTo} state={{ from: location }} replace />;
  }

  if (staffOnly && !isStaff) {
    return <Navigate to="/" replace />;
  }

  return <>{children}</>;
}