import { SessionIdleGuard } from "@/components/auth/session-idle-guard";
import {
  buildSessionGuardProps,
  type PortalSessionProfile,
} from "@/lib/auth/portal-session";
import { sessionIdleExpireSeconds, sessionIdleWarnSeconds } from "@/lib/server/session-idle";

type PortalSessionGuardProps = {
  profile: PortalSessionProfile;
  /** The raw access token from the portal's own cookie (decoded here for `iat`/`exp` only). */
  token: string | null | undefined;
};

/**
 * The one way either portal mounts the idle guard.
 *
 * Staff `app/dashboard/layout.tsx` and the customer `app/customer/[tenant]/layout.tsx` both
 * render this and nothing else, so the idle window, warning lead, hard-expiry tracking, probe and
 * "Continue session" refresh are identical for `/login` and `/customer/{tenant}/login` sessions.
 * Only the {@link PortalSessionProfile} (URLs + storage key) differs.
 *
 * Server component on purpose: the windows come from server env and the token's remaining life
 * must be measured server-side (see {@link buildSessionGuardProps}).
 */
export function PortalSessionGuard({ profile, token }: Readonly<PortalSessionGuardProps>) {
  return (
    <SessionIdleGuard
      {...buildSessionGuardProps(profile, token, {
        idleSeconds: sessionIdleExpireSeconds(),
        warnLeadSeconds: sessionIdleWarnSeconds(),
      })}
    />
  );
}