import { Navigate } from 'react-router-dom'
import { useAuth } from '../contexts/AuthContext.jsx'

// Client-side role gate for admin sub-sections. Real enforcement is server-side
// (requireRole); this just keeps the UI honest — a user without one of `roles`
// is redirected rather than shown a page that will only 403 on every call.
export default function RoleGate({ roles, children, redirect = '/admin' }) {
  const { user } = useAuth()
  if (user && !roles.includes(user.role)) return <Navigate to={redirect} replace />
  return children
}