import { redirect } from "next/navigation";
import { ForbiddenError } from "@raredays/core";
import { getServerSession } from "@raredays/identity/server";
import { app } from "@/lib/runtime";

export default async function ProtectedPage(): Promise<React.ReactElement> {
  const session = await getServerSession(app);
  if (!session) {
    redirect("/");
  }

  // Framework-owned authz: gate on a permission, not a role string, through
  // the permission port (framework ADR-0025) in the user's organization.
  const { user } = session;
  const allowed = await app
    .require("permissionProvider")
    .hasPermission(user, "content", "read", user.organizationId);
  if (!allowed) throw new ForbiddenError({ permission: "content.read" });

  return (
    <main data-testid="protected" className="p-8 font-sans">
      <h1 className="text-2xl font-bold">Protected</h1>
      <p className="mt-3" data-testid="signed-in-as">
        Signed in as {session.user.email}
      </p>
      <p className="mt-1 text-sm text-neutral-600" data-testid="user-id">
        User id: {session.user.id}
      </p>
    </main>
  );
}