kitchen/frontend/src/components/AuthGate.tsx

import { createContext, useContext, useEffect, useRef, useState } from 'react'
import type { ReactNode } from 'react'
import type { User } from '../types'

function getInactivityMs(): number | null {
  if (window.matchMedia('(display-mode: standalone)').matches) return null
  const c = document.cookie.split(';').map(s => s.trim()).find(s => s.startsWith('hnf_inactivity_mins='))
  if (!c) return null
  const mins = parseInt(c.split('=')[1])
  return isNaN(mins) || mins <= 0 ? null : mins * 60 * 1000
}

// Only bounce to the central login when actually embedded in the portal shell.
// A standalone PWA or a directly-opened browser tab must never navigate away
// from its own start_url/scope — otherwise it loses its installed-app context.
function isEmbedded() {
  return window.top !== window
}

function verify(): Promise<User> {
  return fetch('/kitchen/api/auth/verify?app=kitchen', { credentials: 'include' })
    .then(r => {
      if (!r.ok) throw new Error('unauth')
      return r.json()
    })
    .then((data): User => ({
      email: data.email || data.sub || '',
      name: data.name || data.display_name || '',
      is_admin: data.is_admin ?? false,
      caps: data.caps ?? [],
    }))
}

// Compatibility shim: archive components destructure token/login/logout/restrictedPages
// from useAuth(). These stubs keep the TypeScript build clean. Runtime behaviour:
//   token = "__session__" (truthy so component guards pass; backends ignore the
//   Authorization header and use the hnf_session cookie — see log B5b for full migration).
//   restrictedPages = [] (replaced by cap-based access control).
//   logout = clears the session and returns to the sign-in screen.
//   login = no-op (cookie auth, no local token).
interface AuthCtx {
  user: User
  token: string
  restrictedPages: string[]
  login: (t: string) => void
  logout: () => void
}
const Ctx = createContext<AuthCtx | null>(null)

export function useAuth() {
  const ctx = useContext(Ctx)
  if (!ctx) throw new Error('useAuth outside AuthGate')
  return ctx
}

export default function AuthGate({ children }: { children: ReactNode }) {
  const [state, setState] = useState<'checking' | 'authed' | 'login'>('checking')
  const [user, setUser] = useState<User | null>(null)
  const [email, setEmail] = useState('')
  const [password, setPassword] = useState('')
  const [error, setError] = useState('')
  const [loading, setLoading] = useState(false)
  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null)

  useEffect(() => {
    verify()
      .then(data => { setUser(data); setState('authed') })
      .catch(() => {
        if (isEmbedded()) window.top!.location.href = `/login?from=${encodeURIComponent('/app/kitchen')}`
        else setState('login')
      })
  }, [])

  // Inactivity auto-logout — disabled for installed PWAs; configurable per
  // device (Admin Settings → Device) for shared/front-desk browser sessions.
  useEffect(() => {
    const ms = getInactivityMs()
    if (state !== 'authed' || !ms) return
    const timeoutMs: number = ms

    async function forceLogout() {
      await fetch('/kitchen/api/auth/logout', { method: 'POST', credentials: 'include' }).catch(() => {})
      setUser(null)
      setState('login')
    }

    function reset() {
      if (timerRef.current) clearTimeout(timerRef.current)
      timerRef.current = setTimeout(forceLogout, timeoutMs)
    }

    const events = ['mousemove', 'keydown', 'click', 'touchstart'] as const
    events.forEach(e => window.addEventListener(e, reset, { passive: true }))
    reset()

    return () => {
      if (timerRef.current) clearTimeout(timerRef.current)
      events.forEach(e => window.removeEventListener(e, reset))
    }
  }, [state])

  async function login(e: React.FormEvent) {
    e.preventDefault()
    setLoading(true)
    setError('')
    try {
      const res = await fetch('/kitchen/api/auth/login', {
        method: 'POST', credentials: 'include',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ email, password }),
      })
      if (!res.ok) { setError('Invalid email or password'); return }
      setUser(await verify())
      setState('authed')
    } catch {
      setError('Connection error — please try again')
    } finally {
      setLoading(false)
    }
  }

  if (state === 'checking') {
    return (
      <div style={{ minHeight: '100vh', display: 'flex', alignItems: 'center', justifyContent: 'center', background: 'var(--navy-dark)' }}>
        <div className="spinner" style={{ width: 32, height: 32 }} />
      </div>
    )
  }

  if (state === 'login') {
    return (
      <div style={{
        display: 'flex', flexDirection: 'column', alignItems: 'center',
        justifyContent: 'center', minHeight: '100vh', padding: '1.5rem',
        background: 'var(--navy-dark)',
      }}>
        <div style={{
          background: 'var(--navy)', borderRadius: 'var(--radius)',
          padding: '2rem', width: '100%', maxWidth: '360px',
          border: '1px solid var(--surface-2)',
        }}>
          <h1 style={{ fontSize: '1.4rem', marginBottom: '0.25rem', color: 'var(--gold)' }}>
            Kitchen
          </h1>
          <p style={{ color: 'var(--text-muted)', fontSize: '0.875rem', marginBottom: '1.5rem' }}>
            {import.meta.env.VITE_HOTEL_NAME}
          </p>
          <form onSubmit={login} style={{ display: 'flex', flexDirection: 'column', gap: '0.75rem' }}>
            <input type="email" value={email} onChange={e => setEmail(e.target.value)}
              placeholder="Email" required autoComplete="email" style={inputStyle} />
            <input type="password" value={password} onChange={e => setPassword(e.target.value)}
              placeholder="Password" required autoComplete="current-password" style={inputStyle} />
            {error && <p style={{ color: 'var(--danger)', fontSize: '0.875rem' }}>{error}</p>}
            <button type="submit" disabled={loading} style={{
              background: loading ? 'var(--surface-2)' : 'var(--gold)',
              color: loading ? 'var(--text-muted)' : 'var(--navy-dark)',
              border: 'none', borderRadius: '6px', padding: '0.625rem',
              fontSize: '1rem', fontWeight: 600, marginTop: '0.25rem',
            }}>
              {loading ? 'Signing in…' : 'Sign in'}
            </button>
          </form>
        </div>
      </div>
    )
  }

  const ctx: AuthCtx = {
    user: user!,
    token: '__session__',
    restrictedPages: [],
    login: () => {},
    logout: () => {
      fetch('/kitchen/api/auth/logout', { method: 'POST', credentials: 'include' }).catch(() => {})
      if (isEmbedded()) window.top!.location.href = '/login'
      else { setUser(null); setState('login') }
    },
  }

  return <Ctx.Provider value={ctx}>{children}</Ctx.Provider>
}

const inputStyle: React.CSSProperties = {
  background: 'var(--navy-dark)', border: '1px solid var(--surface-2)',
  borderRadius: '6px', color: 'var(--text)', padding: '0.625rem 0.75rem',
  fontSize: '1rem', width: '100%', outline: 'none',
}