import type { CanActivateFn } from '@angular/router';
import { environment } from 'environments/environment';
import { AUTH_STRATEGY } from '../../../../../environments/environment.type';

/**
 * Gates the `/auth` route group based on the configured authentication strategy.
 *
 * - AUTH_STRATEGY.PASSWORD            → returns true (local login routes are reachable as usual).
 * - AUTH_STRATEGY.AUTHORIZATION_CODE  → redirects the browser to the hub launcher and returns
 *   false, preventing the local login form from ever rendering. In this mode the
 *   satellite has no local authentication UI; all credential exchange happens at
 *   the remote hub.
 *
 * This guard is placed on the `path: 'auth'` route in app.routes.ts so that
 * every child route (sign-in, sign-up, …) is protected by a single decision.
 * It intentionally does NOT consult AuthenticationService because the decision
 * is purely strategic (which flow is active), not based on the user's current
 * session state.
 */
export const noLocalAuthGuard: CanActivateFn = () => {
  if (environment.authStrategy === AUTH_STRATEGY.AUTHORIZATION_CODE) {
    window.location.href = `${environment.api.rest}/auth/login`;
    return false;
  }

  return true;
};
