import { allowed } from './token.js';

/** Redirect HTML to the staff login when STAFF_AUTH=1. JSON APIs stay open unless STAFF_AUTH_JSON=1. */
export function staffHtmlGuard(req, res, url) {
  if (process.env.STAFF_AUTH !== '1') return false;
  const html = req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html');
  if (!html) return false;
  if (allowed(req)) return false;
  const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
  const next = `http://${req.headers.host || '127.0.0.1'}${url.pathname}`;
  res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent(next)}` });
  res.end();
  return true;
}