import { NextRequest, NextResponse } from "next/server";
import { SESSION_COOKIE_NAME, verifySessionToken } from "@/lib/auth/session";
import { createLogger } from "@/lib/logger";

const log = createLogger("auth");

export default async function proxy(req: NextRequest) {
  const { pathname } = req.nextUrl;
  const isAuthenticated = await verifySessionToken(req.cookies.get(SESSION_COOKIE_NAME)?.value);

  if (isAuthenticated) {
    if (pathname === "/login") {
      return NextResponse.redirect(new URL("/", req.url));
    }
    return NextResponse.next();
  }

  if (pathname.startsWith("/api/")) {
    log.warn("rejected unauthenticated request", { path: pathname, method: req.method });
    return NextResponse.json({ error: "unauthorized" }, { status: 401 });
  }

  log.warn("redirecting unauthenticated request to login", { path: pathname });
  const loginUrl = new URL("/login", req.url);
  loginUrl.searchParams.set("from", pathname);
  return NextResponse.redirect(loginUrl);
}

export const config = {
  matcher: [
    "/((?!_next/static|_next/image|favicon.ico|icon.svg|manifest.webmanifest|login|api/auth/login|api/health).*)",
  ],
};