check this file:

import { Navigate, useLocation } from "react-router-dom";
import { useAuth, UserRole } from "@/contexts/AuthContext";

interface ProtectedRouteProps {
  children: React.ReactNode;
  requiredUserType?: UserRole;
  requireSupervisor?: boolean;
  requireSameSchool?: boolean;
  schoolId?: string;
  allowedRoles?: Array<UserRole>;
}

const ProtectedRoute = ({ 
  children, 
  requiredUserType,
  allowedRoles, 
  requireSupervisor = false,
  requireSameSchool = false,
  schoolId
}: ProtectedRouteProps) => {
  const { user, profile, isSuperviser, isLoading, userRole, schoolId: userSchoolId } = useAuth();
  const location = useLocation();

  // Check if we're using a test account
  const usingTestAccount = localStorage.getItem('usingTestAccount') === 'true';
  const testAccountType = localStorage.getItem('testAccountType') as UserRole | null;

  if (isLoading) {
    return <div className="flex items-center justify-center h-screen">Loading...</div>;
  }

  // Not logged in and not using a test account
  if (!user && !usingTestAccount) {
    return <Navigate to="/login" state={{ from: location }} replace />;
  }

  // Special handling for test accounts
  if (usingTestAccount && testAccountType) {
    // For test accounts, check if the role is allowed
    if (requiredUserType && testAccountType !== requiredUserType) {
      console.log(`ProtectedRoute: Test account role ${testAccountType} doesn't match required role ${requiredUserType}`);
      const redirectPath = 
        testAccountType === 'school' ? '/admin' : 
        testAccountType === 'teacher' ? '/teacher/analytics' : 
        '/dashboard';
      return <Navigate to={redirectPath} replace />;
    }

    // Check allowed roles for test accounts
    if (allowedRoles && !allowedRoles.includes(testAccountType)) {
      console.log(`ProtectedRoute: Test account role ${testAccountType} not in allowed roles:`, allowedRoles);
      const redirectPath = 
        testAccountType === 'school' ? '/admin' : 
        testAccountType === 'teacher' ? '/teacher/analytics' : 
        '/dashboard';
      return <Navigate to={redirectPath} replace />;
    }

    // Test school admin is always a supervisor
    if (requireSupervisor && testAccountType !== 'school') {
      console.log(`ProtectedRoute: Test account is not a supervisor`);
      const redirectPath = 
        testAccountType === 'school' ? '/admin' : 
        testAccountType === 'teacher' ? '/teacher/analytics' : 
        '/dashboard';
      return <Navigate to={redirectPath} replace />;
    }
  } else {
    // Normal authenticated user checks
    
    // Log current user role for debugging
    console.log("ProtectedRoute: User role:", userRole, "Required role:", requiredUserType);

    // If we require a specific user type and the user doesn't have it
    // Safely handle userRole by ensuring it's treated as UserRole type when it exists
    if (requiredUserType && userRole) {
      const typedUserRole = userRole as UserRole;
      if (typedUserRole !== requiredUserType) {
        console.log(`ProtectedRoute: User role ${userRole} doesn't match required role ${requiredUserType}`);
        // Redirect based on user role instead of generic dashboard
        const redirectPath = 
          typedUserRole === 'school' ? '/admin' : 
          typedUserRole === 'teacher' ? '/teacher/analytics' : 
          '/dashboard';
        return <Navigate to={redirectPath} replace />;
      }
    }

    // If we require specific roles and the user doesn't have one of them
    if (allowedRoles && userRole) {
      const typedUserRole = userRole as UserRole;
      if (!allowedRoles.includes(typedUserRole)) {
        console.log(`ProtectedRoute: User role ${userRole} not in allowed roles:`, allowedRoles);
        // Redirect based on user role instead of generic dashboard
        const redirectPath = 
          typedUserRole === 'school' ? '/admin' : 
          typedUserRole === 'teacher' ? '/teacher/analytics' : 
          '/dashboard';
        return <Navigate to={redirectPath} replace />;
      }
    }

    // If we require supervisor access and the user isn't a supervisor
    if (requireSupervisor && !isSuperviser) {
      console.log(`ProtectedRoute: User is not a supervisor`);
      // Redirect based on user role instead of generic dashboard
      const redirectPath = 
        userRole === 'school' ? '/admin' : 
        userRole === 'teacher' ? '/teacher/analytics' : 
        '/dashboard';
      return <Navigate to={redirectPath} replace />;
    }

    // If we require same school access and the school IDs don't match
    if (requireSameSchool && schoolId && userSchoolId && schoolId !== userSchoolId) {
      console.log(`ProtectedRoute: School ID mismatch - user: ${userSchoolId}, required: ${schoolId}`);
      // Redirect based on user role
      const redirectPath = 
        userRole === 'school' ? '/admin' : 
        userRole === 'teacher' ? '/teacher/analytics' : 
        '/dashboard';
      return <Navigate to={redirectPath} replace />;
    }
  }

  return <>{children}</>;
};

export default ProtectedRoute;