import { redirect } from 'next/navigation'
import { getUserSession, hasPermission } from '@/lib/auth/permissions'
import AppShell from '@/components/layout/app-shell'

export const metadata = {
  title: 'Wertstrom — SupplierPulse',
}

export const dynamic = 'force-dynamic'

export default async function WertstromLayout({
  children,
}: {
  children: React.ReactNode
}) {
  // Permissions-Enforcement (Wertstrom P0, KAR-878): vsm.read gate for both
  // pages under /wertstrom (list + editor) in one place — the previous
  // getClaims()-only check verified authentication but never authorization.
  // No dedicated "access denied" page exists in this repo yet (only the
  // existing redirect('/login') convention every other section's layout
  // already uses for the unauthenticated case) — an authenticated user who
  // simply lacks vsm.read is redirected to the app's own post-login landing
  // page (app/page.tsx) instead of a misleading "please log in" prompt.
  const session = await getUserSession()
  if (!session) redirect('/login')
  if (!hasPermission(session, 'vsm.read')) redirect('/projektanlage')

  return <AppShell>{children}</AppShell>
}