import type { ReactNode } from "react";

import { customerPageAllows } from "@/app/customer/_lib/customer-page-guard";
import type { CustomerRouteGuard } from "@/app/customer/_lib/customer-route-guard";
import { AccessDeniedView } from "@/app/customer/_components/access-denied-view";

type TransactionPageGuardProps = {
  tenant: string;
  /** Route key, several acceptable route keys, or an explicit NO_ROUTE_KEY_REQUIRED opt-out. */
  routeKeys: CustomerRouteGuard;
  /** Asset-class name as the reader knows it, e.g. "Bond". */
  label: string;
  children: ReactNode;
};

/**
 * Page-level permission gate for the Transactions hub and its asset-class list pages
 * (stock, bond, commodity, fx-currency/*, ...).
 *
 * These pages had NO page-level guard at all before this: a reader without the route key
 * still got the full list-page shell, and denial (if it happened) only came from the
 * underlying `list` BFF route's own 403 — often surfacing as a bare empty table or a stray
 * error string, never a clear "you don't have access" moment. Mirrors `ReportPageGuard`
 * (app/customer/[tenant]/reports/_shared/components/report-page-guard.tsx) for the same
 * reason and with the same denial UI, just scoped to the Transactions nav group.
 *
 * Denies with `AccessDeniedView` rather than a 404: these pages are reachable from
 * persistent sidebar nav, so the reader already knows the section exists.
 */
export async function TransactionPageGuard({ tenant, routeKeys, label, children }: TransactionPageGuardProps) {
  if (!(await customerPageAllows(tenant, routeKeys))) {
    return <AccessDeniedView label={label} />;
  }

  return <>{children}</>;
}