// ── Global User State ──
var currentUser = null;

// ── App Init ──

document.addEventListener('DOMContentLoaded', async () => {
  // Auth-Check: Eingeloggt?
  var user = await apiMe();
  if (!user) {
    await navigateTo('login', {}, { replace: true });
    return;
  }

  currentUser = user;

  const { page, id } = parseHash();
  var target = page === 'login' ? 'dashboard' : page;
  await navigateTo(target, { id }, { replace: true });
});

// Browser Zurück/Vor-Button
window.addEventListener('popstate', async (e) => {
  var page, id;
  if (e.state && e.state.page) {
    page = e.state.page;
    id = e.state.params ? e.state.params.id : null;
  } else {
    const parsed = parseHash();
    page = parsed.page;
    id = parsed.id;
  }

  // Login-Seite immer erlauben, alles andere nur wenn eingeloggt
  if (page !== 'login') {
    var user = await apiMe();
    if (!user) {
      await navigateTo('login', {}, { replace: true });
      return;
    }
  }

  await navigateTo(page, { id }, { replace: true });
});