middleware.js

// ============================================================
// middleware.js
// Session refresh and route protection middleware using @supabase/ssr
// ============================================================

export const runtime = "nodejs";

import { createServerClient } from "@supabase/ssr";
import { NextResponse } from "next/server";

export async function middleware(request) {
  let response = NextResponse.next({
    request: { headers: request.headers },
  });

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
    {
      cookies: {
        get(name) {
          return request.cookies.get(name)?.value;
        },
        set(name, value, options) {
          request.cookies.set({ name, value, ...options });
          response = NextResponse.next({ request: { headers: request.headers } });
          response.cookies.set({ name, value, ...options });
        },
        remove(name, options) {
          request.cookies.set({ name, value: "", ...options });
          response = NextResponse.next({ request: { headers: request.headers } });
          response.cookies.set({ name, value: "", ...options });
        },
      },
    }
  );

  const { data: { user } } = await supabase.auth.getUser();
  const { pathname } = request.nextUrl;

  // Protect all /dashboard routes (app route group)
  if (pathname.startsWith("/dashboard")) {
    if (!user) {
      // Redirect to login with ?redirect query param
      const redirectUrl = request.nextUrl.clone();
      redirectUrl.pathname = "/login";
      redirectUrl.searchParams.set("redirect", pathname + request.nextUrl.search);
      return NextResponse.redirect(redirectUrl);
    }

    // Read the user's role from their profile in the database
    const { data: profile } = await supabase
      .from("profiles")
      .select("role")
      .eq("id", user.id)
      .single();

    const userRole = profile?.role || "visitor";

    // TODO: add active-subscription check here
    const { data: subscription } = await supabase
      .from("subscriptions")
      .select("status")
      .eq("user_id", user.id)
      .eq("status", "active")
      .maybeSingle();

    const isSubscribed = subscription?.status === "active";

    // Gating non-admin users without active subscriptions
    const isCheckoutSuccess = request.nextUrl.searchParams.get("checkout") === "success";
    if (userRole !== "admin" && !isSubscribed && !isCheckoutSuccess) {
      const redirectUrl = request.nextUrl.clone();
      redirectUrl.pathname = "/subscribe";
      return NextResponse.redirect(redirectUrl);
    }

    // Role-based route protection: deny non-admins from admin sections
    if (pathname.startsWith("/dashboard/admin") && userRole !== "admin") {
      const redirectUrl = request.nextUrl.clone();
      redirectUrl.pathname = "/dashboard";
      return NextResponse.redirect(redirectUrl);
    }
  }

  // Redirect authenticated users trying to access login/signup back to dashboard
  if (user && (pathname === "/login" || pathname === "/signup")) {
    const redirectUrl = request.nextUrl.clone();
    redirectUrl.pathname = "/dashboard";
    return NextResponse.redirect(redirectUrl);
  }

  return response;
}

export const config = {
  matcher: [
    /*
     * Match all request paths EXCEPT:
     * - _next/static  (static assets)
     * - _next/image   (image optimization)
     * - favicon.ico
     * - Public static files (png, jpg, etc.)
     */
    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)",
  ],
};