import { redirect } from "next/navigation";

import ForcedPasswordChange from "@/components/admin/ForcedPasswordChange";
import { readSession } from "@/lib/api/admin-server";

export const dynamic = "force-dynamic";

export const metadata = { title: "Set your password — RSVP Admin" };

/**
 * The one screen a confined session can reach (design D14).
 *
 * Deliberately **outside** the `(protected)` group: that layout redirects a confined session
 * here, so living inside it would be an infinite redirect. The two guards it needs are
 * therefore repeated by hand, and they are the opposite pair — no session goes to sign-in,
 * and a session that is *not* confined goes to the dashboard, so this screen cannot be used
 * as a way to change a password without knowing the current one.
 */
export default async function ForcedPasswordChangePage() {
  const session = await readSession();
  if (!session) redirect("/admin/signin");
  if (!session.must_change_password) redirect("/admin");

  return (
    <main className="mx-auto flex min-h-dvh w-full max-w-md flex-col justify-center px-4 py-12">
      <h1 className="text-xl font-semibold tracking-tight text-stone-900">Set your password</h1>
      <p className="mt-2 text-sm text-stone-600">
        You signed in with a temporary password. Choose your own before you continue —
        everything else is unavailable until you do.
      </p>
      <ForcedPasswordChange email={session.email} />
    </main>
  );
}