export default defineEventHandler((event) => {
  if (!authEnabled()) return
  const path = event.path || getRequestURL(event).pathname
  if (
    path.startsWith('/api/auth/login') ||
    path.startsWith('/api/auth/callback') ||
    path.startsWith('/api/auth/logout') ||
    path.startsWith('/api/auth/me') ||
    path.startsWith('/api/health') ||
    path.startsWith('/api/monitor') ||
    path.startsWith('/api/library/backup-ingest') ||
    path.startsWith('/_nuxt') ||
    path.startsWith('/favicon') ||
    path === '/login'
  ) {
    return
  }
  const user = getSessionUser(event)
  if (user) return
  if (path.startsWith('/api/')) {
    throw createError({ statusCode: 401, statusMessage: 'Authentication required' })
  }
  return sendRedirect(event, '/login', 302)
})