spsays-training/components/password-gate.tsx

"use client";

import { useState, useEffect, type ReactNode } from "react";
import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
import { Input } from "@/components/ui/input";

/**
 * PasswordGate — a simple client-side password protection layer.
 *
 * How it works:
 *   1. On mount, asks the server (GET /api/verify-access) whether protection is enabled.
 *   2. If not enabled, renders children immediately (no gate).
 *   3. If enabled, checks sessionStorage for a stored access key.
 *   4. If found, validates it against the server via POST /api/verify-access.
 *   5. If not found or invalid, shows a password prompt.
 *   6. On correct password, stores it in sessionStorage and renders children.
 *
 * Environment:
 *   - ACCESS_KEY env variable must be set on the server for protection to activate.
 *   - If ACCESS_KEY is not set, the gate is bypassed entirely.
 *
 * This is intentionally simple and modular — remove the <PasswordGate> wrapper
 * from layout.tsx to disable it entirely.
 */

const SESSION_KEY = "spsays_access";
const API_ENDPOINT = "/api/verify-access";

export function PasswordGate({ children }: { children: ReactNode }) {
  const [status, setStatus] = useState<"loading" | "locked" | "unlocked">(
    "loading",
  );
  const [password, setPassword] = useState("");
  const [error, setError] = useState("");
  const [verifying, setVerifying] = useState(false);

  async function verifyKey(key: string): Promise<boolean> {
    try {
      const res = await fetch(API_ENDPOINT, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ key }),
      });
      if (!res.ok) return false;
      const data = await res.json();
      return data.valid === true;
    } catch {
      return false;
    }
  }

  useEffect(() => {
    async function init() {
      // Step 1: Ask server if protection is enabled
      try {
        const res = await fetch(API_ENDPOINT);
        const data = await res.json();

        if (!data.enabled) {
          // No ACCESS_KEY set on server — bypass gate
          setStatus("unlocked");
          return;
        }
      } catch {
        // If we can't reach the server, unlock to avoid blocking the site
        setStatus("unlocked");
        return;
      }

      // Step 2: Protection is enabled — check sessionStorage
      const stored = sessionStorage.getItem(SESSION_KEY);
      if (stored) {
        const ok = await verifyKey(stored);
        if (ok) {
          setStatus("unlocked");
          return;
        }
        // Stored key is invalid — clear it
        sessionStorage.removeItem(SESSION_KEY);
      }

      setStatus("locked");
    }

    init();
  }, []);

  async function handleSubmit(e: React.FormEvent) {
    e.preventDefault();
    if (!password.trim()) return;

    setVerifying(true);
    setError("");

    const ok = await verifyKey(password.trim());
    if (ok) {
      sessionStorage.setItem(SESSION_KEY, password.trim());
      setStatus("unlocked");
    } else {
      setError("Invalid access key. Please try again.");
    }
    setVerifying(false);
  }

  // Loading state — brief flash while checking with server
  if (status === "loading") {
    return (
      <div className="min-h-screen bg-background flex items-center justify-center">
        <div className="text-muted-foreground text-sm">Loading…</div>
      </div>
    );
  }

  // Unlocked — render the app
  if (status === "unlocked") {
    return <>{children}</>;
  }

  // Locked — show password prompt
  return (
    <div className="min-h-screen bg-background flex items-center justify-center px-4">
      <Card className="w-full max-w-sm">
        <CardHeader className="text-center">
          <CardTitle className="text-2xl font-bold">Prabhupāda Says</CardTitle>
          <p className="text-sm text-muted-foreground mt-1">
            Enter the access key to continue
          </p>
        </CardHeader>
        <CardContent>
          <form onSubmit={handleSubmit} className="space-y-4">
            <Input
              type="password"
              placeholder="Access key"
              value={password}
              onChange={(e) => {
                setPassword(e.target.value);
                if (error) setError("");
              }}
              autoFocus
              disabled={verifying}
            />
            {error && (
              <p className="text-sm text-destructive text-center">{error}</p>
            )}
            <button
              type="submit"
              disabled={verifying || !password.trim()}
              className="w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
            >
              {verifying ? "Verifying…" : "Enter"}
            </button>
          </form>
        </CardContent>
      </Card>
    </div>
  );
}