const PROTECTED_PREFIXES = ['/api/diary/', '/api/notes/']

export default defineEventHandler(async (event) => {
  const path = event.path.split('?')[0]!
  if (!PROTECTED_PREFIXES.some(prefix => path.startsWith(prefix))) return

  const session = await authSession(event)
  if (!session.data.unlocked) {
    throw createError({ statusCode: 401, statusMessage: 'Locked' })
  }
})