import { error, redirect, type Handle } from '@sveltejs/kit';
import { validateSession } from '$lib/server/auth';

const AUTH_PATHS = new Set(['/login', '/signup']);

function isPublic(path: string): boolean {
	return path === '/' || AUTH_PATHS.has(path) || /^\/activities\/\d+$/.test(path);
}

export const handle: Handle = async ({ event, resolve }) => {
	event.locals.user = validateSession(event.cookies.get('session'));

	const path = event.url.pathname;
	if (!event.locals.user && !isPublic(path)) {
		if (path.startsWith('/api/')) error(401, 'Not signed in');
		redirect(303, '/login');
	}
	if (event.locals.user && AUTH_PATHS.has(path)) {
		redirect(303, '/');
	}

	return resolve(event);
};