import NextAuth from "next-auth";
import { NextResponse } from "next/server";
import { authConfig } from "@/auth.config";

// /home, /appointments and /settings are intentionally NOT hard-gated here
// as of Phase 4 — Home must work for guests (public business browsing +
// booking), and /appointments and /settings each show their own friendly
// in-context sign-in prompt for a guest rather than a silent redirect with
// no explanation. Only /staff and /owner remain hard-gated: those are
// permission-based tooling with no meaningful "guest" experience at all.
const PROTECTED_PREFIXES = ["/staff", "/owner"];

// Lightweight instance built from the DB-free config — see auth.config.ts.
// Next.js 16 renamed this file convention from `middleware` to `proxy`
// (https://nextjs.org/docs/messages/middleware-to-proxy); it now always
// runs on the Node.js runtime rather than Edge, but this stays split from
// the full `@/auth` regardless, so checking "is there a session" doesn't
// spin up a Postgres connection pool on every request.
const { auth } = NextAuth(authConfig);

export default auth((req) => {
  const { pathname } = req.nextUrl;
  const isProtected = PROTECTED_PREFIXES.some(
    (prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`),
  );

  if (isProtected && !req.auth) {
    const signInUrl = new URL("/sign-in", req.nextUrl.origin);
    signInUrl.searchParams.set("callbackUrl", pathname);
    return NextResponse.redirect(signInUrl);
  }
});

export const config = {
  matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
};