import { NextResponse, type NextRequest } from "next/server";
import { SESSION_COOKIE_NAME, verifySessionToken } from "@/lib/session";

// Next.js 16 renamed the `middleware.ts` file convention to `proxy.ts`
// (https://nextjs.org/docs/messages/middleware-to-proxy) — it now always
// runs on the Node.js runtime, which is why plain `node:crypto` in
// session.ts works fine here without any Edge-runtime workaround.

const PUBLIC_PATHS = ["/login"];

export default function proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;
  if (PUBLIC_PATHS.some((path) => pathname.startsWith(path))) return NextResponse.next();

  const token = request.cookies.get(SESSION_COOKIE_NAME)?.value;
  const session = verifySessionToken(token);
  if (!session) {
    const loginUrl = new URL("/login", request.url);
    return NextResponse.redirect(loginUrl);
  }

  return NextResponse.next();
}

export const config = {
  // Runs on every page and API route except static assets — this app has
  // no public-facing content at all, unlike the main app's proxy.ts,
  // which has to carve out installation/customer-facing exceptions.
  //
  // api/backups/upload is excluded deliberately: a proxy buffers (and
  // truncates at 10 MB) every request body it sees, which would corrupt a
  // large backup upload. That route verifies the session cookie itself.
  matcher: ["/((?!_next/static|_next/image|favicon.ico|api/backups/upload).*)"],
};