const ACCESS_STORAGE_KEY = "access_ok";

async function checkAccess() {
  if (sessionStorage.getItem(ACCESS_STORAGE_KEY) === "1") {
    return true;
  }

  const params = new URLSearchParams(window.location.search);
  const urlToken = params.get("access");

  if (!urlToken) {
    return false;
  }

  try {
    const config = await loadAppConfig();
    if (urlToken === config.accessToken) {
      sessionStorage.setItem(ACCESS_STORAGE_KEY, "1");
      params.delete("access");
      const newSearch = params.toString();
      const newUrl =
        window.location.pathname + (newSearch ? "?" + newSearch : "") + window.location.hash;
      window.history.replaceState({}, "", newUrl);
      return true;
    }
  } catch (e) {
    console.error("Access check failed:", e);
  }

  return false;
}

function showAccessDenied() {
  const overlay = document.createElement("div");
  overlay.className = "access-denied";
  overlay.innerHTML = `
    <div class="access-denied__icon">🔒</div>
    <h2 class="access-denied__title">请使用专属二维码访问</h2>
    <p class="access-denied__desc">本服务仅对指定用户开放<br>请扫描管理员提供的二维码进入</p>
  `;
  document.body.appendChild(overlay);
}

async function initAccessGuard() {
  const allowed = await checkAccess();
  if (!allowed) {
    showAccessDenied();
    return false;
  }
  return true;
}