export default defineNuxtRouteMiddleware(async (to) => {
  const auth = useAuth()

  // Se c'è un token ma l'utente non è ancora caricato e non stiamo già sincronizzando, sincronizza
  if ((auth.token.value || auth.tokenState.value) && !auth.user.value && !auth.isSyncingUser.value) {
    try {
      await auth.syncUser({ currentPath: to.path })
    } catch (error) {
      console.error('[Auth Middleware] Sync failed:', error)
      return navigateTo('/auth/login')
    }
  }

  // Se non autenticato, redirige al login
  if (!auth.isAuthenticated.value) {
    return navigateTo('/auth/login')
  }

  // Verifica ruoli se richiesto
  const requiredRole = to.meta.auth?.role

  if (requiredRole && auth.user.value) {
    const userRole = auth.user.value.role.toUpperCase()

    const roleLevels: Record<string, number> = {
      'CITIZEN': 1,
      'OPERATOR': 2,
      'ADMIN': 3
    }

    const userLevel = roleLevels[userRole] || 0
    const requiredLevel = roleLevels[requiredRole] || 0

    if (userLevel < requiredLevel) {
      console.warn(`[Auth] User role ${userRole} (level ${userLevel}) insufficient for required ${requiredRole} (level ${requiredLevel})`)
      return navigateTo('/')
    }
  }
})