import { betterFetch } from '@better-fetch/fetch';
import { type NextRequest, NextResponse } from 'next/server';

import type { auth } from '@/lib/auth';

// Define Session type based on auth module's session type
type Session = typeof auth.$Infer.Session;

/**
 * Middleware to protect routes by checking if user is authenticated
 * @param request - The incoming Next.js request object
 * @returns NextResponse with either redirect or next()
 */
export default async function authMiddleware(request: NextRequest) {
  // Fetch the current session by making API call to auth endpoint
  const { data: session } = await betterFetch<Session>(
    '/api/auth/get-session',
    {
      baseURL: request.nextUrl.origin,
      headers: {
        // Get the cookie from the request headers
        cookie: request.headers.get('cookie') || '',
      },
    },
  );

  // If no session exists, redirect to sign-in page
  const isSignInRoute = request.nextUrl.pathname === '/sign-in';
  if (!session && !isSignInRoute) {
    return NextResponse.redirect(new URL('/sign-in', request.url));
  }

  if (session && isSignInRoute) {
    // Redirect signed-in users attempting to access sign-in page
    return NextResponse.redirect(new URL('/', request.url));
  }
  // Check if route requires admin access
  const isAdminRoute = request.nextUrl.pathname.startsWith('/admin');
  if (isAdminRoute && session?.user.role !== 'admin') {
    // Redirect non-admin users attempting to access admin routes
    return NextResponse.redirect(new URL('/', request.url));
  }

  // Otherwise allow request to continue
  return NextResponse.next();
}

// Configure which routes this middleware should run on
export const config = {
  matcher: ['/dashboard', '/admin/:path*', '/sign-in'],
};

import { betterFetch } from '@better-fetch/fetch';
import { type NextRequest, NextResponse } from 'next/server';

import type { auth } from '@/lib/auth';

// Define Session type based on auth module's session type
type Session = typeof auth.$Infer.Session;

/**
 * Middleware to protect routes by checking if user is authenticated
 * @param request - The incoming Next.js request object
 * @returns NextResponse with either redirect or next()
 */
export default async function authMiddleware(request: NextRequest) {
  // Fetch the current session by making API call to auth endpoint
  const { data: session } = await betterFetch<Session>(
    '/api/auth/get-session',
    {
      baseURL: request.nextUrl.origin,
      headers: {
        // Get the cookie from the request headers
        cookie: request.headers.get('cookie') || '',
      },
    },
  );

  // If no session exists, redirect to sign-in page
  const isSignInRoute = request.nextUrl.pathname === '/sign-in';
  if (!session && !isSignInRoute) {
    return NextResponse.redirect(new URL('/sign-in', request.url));
  }

  if (session && isSignInRoute) {
    // Redirect signed-in users attempting to access sign-in page
    return NextResponse.redirect(new URL('/', request.url));
  }
  // Check if route requires admin access
  const isAdminRoute = request.nextUrl.pathname.startsWith('/admin');
  if (isAdminRoute && session?.user.role !== 'admin') {
    // Redirect non-admin users attempting to access admin routes
    return NextResponse.redirect(new URL('/', request.url));
  }

  // Otherwise allow request to continue
  return NextResponse.next();
}

// Configure which routes this middleware should run on
export const config = {
  matcher: ['/dashboard', '/admin/:path*', '/sign-in'],
};