from django.shortcuts import redirect
from django.urls import reverse
from urllib.parse import urlencode

class StaffPortalAccessMiddleware:
    """Protect all /staff/ routes, including endpoints without view decorators."""
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        path = request.path_info
        if path.startswith("/staff/") or path == "/staff":
            if path.rstrip("/") != "/staff/login" and not (request.user.is_authenticated and request.user.is_active and request.user.is_staff):
                return redirect(reverse("website:staff_login") + "?" + urlencode({"next": request.get_full_path()}))
        return self.get_response(request)