export default defineNuxtRouteMiddleware(async (to, from) => {
  // Skip auth check on the login page itself
  if (to.path === '/login') {
    return
  }

  // Check for the access_token cookie
  const tokenCookie = useCookie('access_token')
  if (!tokenCookie.value) {
    return navigateTo('/login')
  }

  // ── RBAC: Verify user role from Pinia authStore ──────────────────────
  const authStore = useAuthStore()

  // If the user profile hasn't been loaded yet, try to fetch it
  if (!authStore.user) {
    try {
      await authStore.fetchUser()
    } catch {
      // Token is invalid or expired — clear and redirect to login
      authStore.logout()
      return navigateTo('/login')
    }
  }

  // After fetch, check if user is still null (fetch failed silently)
  if (!authStore.user) {
    authStore.logout()
    return navigateTo('/login')
  }

  // Allowed staff roles that can access the admin panel
  const allowedRoles = ['SUPERADMIN', 'ADMIN', 'MODERATOR', 'SALES_REP', 'SERVICE_MGR']
  const userRole = (authStore.user.role || '').toUpperCase()

  if (!allowedRoles.includes(userRole)) {
    // Standard USER or unknown role — kick them out, clear token, redirect
    authStore.logout()
    return navigateTo('/login')
  }
})