import { redirect } from "next/navigation";
import { auth } from "@/auth";
import { StaffShell } from "@/components/navigation/staff-shell";
import { prisma } from "@/lib/db/prisma";
import { getUnreadNotificationCount } from "@/services/notifications/notification.service";

export default async function StaffLayout({ children }: { children: React.ReactNode }) {
  const session = await auth();
  if (!session?.user) {
    redirect("/sign-in?callbackUrl=/staff");
  }

  // Real role gating, not just "is signed in" — a registered customer with
  // no StaffProfile is bounced back to their own home rather than seeing
  // an empty staff shell. See docs/implementation-plan.md §3 (role
  // conflicts) and §11 (permission enforcement).
  const staffProfile = await prisma.staffProfile.findUnique({ where: { userId: session.user.id } });
  if (!staffProfile) {
    redirect("/home");
  }

  const unreadNotificationCount = await getUnreadNotificationCount(prisma, session.user.id);

  return (
    <StaffShell notificationsHref="/staff/notifications" unreadNotificationCount={unreadNotificationCount}>
      {children}
    </StaffShell>
  );
}