// The demo auth gate. This is intentionally a COOKIE-ONLY stand-in so the
// template boots with zero backend wiring — `login` writes the cookie, the
// admin layout loader reads it. Swap `isSignedIn` for a real check (verify a
// signed session, call your api) when you wire auth for real. See AGENTS.md › Auth.

export const SESSION_COOKIE = 'demo_session'

// Browser-safe cookie parse — NO `node:*` import, so it's safe in the page
// module graph. Runs in BOTH places the gate needs it:
//   - SSR: the loader's `headers['cookie']` (raw Cookie request header)
//   - client nav: `document.cookie` (the loader's `headers` is undefined there)
export const readCookie = (
  header: string | null | undefined,
  name: string,
): string | undefined => {
  if (!header) return undefined
  const match = new RegExp(`(?:^|;\\s*)${name}=([^;]*)`).exec(header)
  return match ? decodeURIComponent(match[1]!) : undefined
}

export const isSignedIn = (headers: Record<string, string | undefined> | undefined): boolean => {
  const cookieHeader = headers?.['cookie'] ?? (typeof document === 'undefined' ? '' : document.cookie)
  return readCookie(cookieHeader, SESSION_COOKIE) !== undefined
}