cameleer-saas/ui/src/router.tsx

import { Routes, Route, Navigate } from 'react-router';
import { LoginPage } from './auth/LoginPage';
import { CallbackPage } from './auth/CallbackPage';
import { ProtectedRoute } from './auth/ProtectedRoute';
import { OrgResolver } from './auth/OrgResolver';
import { Layout } from './components/Layout';
import { RequireScope } from './components/RequireScope';
import { useScopes } from './auth/useScopes';
import { useOrgStore } from './auth/useOrganization';

import { VendorTenantsPage } from './pages/vendor/VendorTenantsPage';
import { CreateTenantPage } from './pages/vendor/CreateTenantPage';
import { TenantDetailPage } from './pages/vendor/TenantDetailPage';
import { VendorAuditPage } from './pages/vendor/VendorAuditPage';
import { TenantDashboardPage } from './pages/tenant/TenantDashboardPage';
import { TenantLicensePage } from './pages/tenant/TenantLicensePage';
import { OidcConfigPage } from './pages/tenant/OidcConfigPage';
import { TeamPage } from './pages/tenant/TeamPage';
import { SettingsPage } from './pages/tenant/SettingsPage';
import { TenantAuditPage } from './pages/tenant/TenantAuditPage';

function LandingRedirect() {
  const scopes = useScopes();
  const { organizations, currentOrgId } = useOrgStore();
  const currentOrg = organizations.find((o) => o.id === currentOrgId);

  // Wait for scopes to be resolved — they're loaded async by OrgResolver.
  // An empty set means "not yet loaded" (even viewer gets observe:read).
  if (scopes.size === 0) {
    return null; // OrgResolver is still fetching tokens
  }

  // Vendor → vendor console
  if (scopes.has('platform:admin')) {
    return <Navigate to="/vendor/tenants" replace />;
  }
  // Tenant admin → tenant portal
  if (scopes.has('tenant:manage')) {
    return <Navigate to="/tenant" replace />;
  }
  // Regular user (operator/viewer) → server dashboard directly
  const serverUrl = currentOrg?.slug ? `/t/${currentOrg.slug}/` : '/server/';
  window.location.href = serverUrl;
  return null;
}

export function AppRouter() {
  return (
    <Routes>
      <Route path="/login" element={<LoginPage />} />
      <Route path="/callback" element={<CallbackPage />} />
      <Route element={<ProtectedRoute />}>
        <Route element={<OrgResolver />}>
          <Route element={<Layout />}>
            {/* Vendor console */}
            <Route path="/vendor/tenants" element={
              <RequireScope scope="platform:admin" fallback={<Navigate to="/tenant" replace />}>
                <VendorTenantsPage />
              </RequireScope>
            } />
            <Route path="/vendor/tenants/new" element={
              <RequireScope scope="platform:admin" fallback={<Navigate to="/tenant" replace />}>
                <CreateTenantPage />
              </RequireScope>
            } />
            <Route path="/vendor/tenants/:id" element={
              <RequireScope scope="platform:admin" fallback={<Navigate to="/tenant" replace />}>
                <TenantDetailPage />
              </RequireScope>
            } />
            <Route path="/vendor/audit" element={
              <RequireScope scope="platform:admin" fallback={<Navigate to="/tenant" replace />}>
                <VendorAuditPage />
              </RequireScope>
            } />

            {/* Tenant portal */}
            <Route path="/tenant" element={<TenantDashboardPage />} />
            <Route path="/tenant/license" element={<TenantLicensePage />} />
            <Route path="/tenant/oidc" element={<OidcConfigPage />} />
            <Route path="/tenant/team" element={<TeamPage />} />
            <Route path="/tenant/audit" element={<TenantAuditPage />} />
            <Route path="/tenant/settings" element={<SettingsPage />} />

            {/* Default redirect — vendor goes to /vendor/tenants, customer to /tenant */}
            <Route index element={<LandingRedirect />} />
          </Route>
        </Route>
      </Route>
    </Routes>
  );
}