const PUBLIC_ROUTES = ['/api/session', '/api/login']

export default defineEventHandler(async (event) => {
  const path = event.path.split('?')[0]!
  if (!path.startsWith('/api/') || PUBLIC_ROUTES.includes(path)) return

  const session = await diarySession(event)
  if (!session.data.unlocked) {
    throw createError({ statusCode: 401, statusMessage: 'The diary is locked' })
  }
})