import { NextResponse, type NextRequest } from "next/server";
import { APP_COOKIE, isValidAppSession } from "@/lib/app-auth";

const PUBLIC_PATHS = new Set(["/login", "/api/login", "/api/logout"]);

function isPublicPath(pathname: string) {
  return (
    PUBLIC_PATHS.has(pathname) ||
    pathname.startsWith("/_next/") ||
    pathname === "/favicon.ico" ||
    pathname === "/robots.txt" ||
    pathname === "/sitemap.xml"
  );
}

function loginUrl(request: NextRequest) {
  const url = request.nextUrl.clone();
  const next = `${request.nextUrl.pathname}${request.nextUrl.search}`;
  url.pathname = "/login";
  url.search = "";
  if (next !== "/") url.searchParams.set("next", next);
  return url;
}

export async function proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;
  if (isPublicPath(pathname)) return NextResponse.next();

  const session = request.cookies.get(APP_COOKIE)?.value;
  if (await isValidAppSession(session)) return NextResponse.next();

  if (pathname.startsWith("/api/")) {
    return NextResponse.json({ detail: "Login required." }, { status: 401 });
  }

  return NextResponse.redirect(loginUrl(request));
}

export const config = {
  matcher: ["/((?!_next/static|_next/image).*)"],
};