proxy.ts

import { clerkMiddleware } from "@clerk/nextjs/server";
import { NextResponse } from "next/server";

import {
  acceptsJsonOverHtml,
  isPublicPath,
  sanitizeRedirectUrl,
} from "@/lib/auth-routing";

const DEVELOPMENT_CLOCK_SKEW_IN_MS = 60_000;

const proxy = clerkMiddleware(
  async (auth, request) => {
    // Public landing, auth, and shared-map routes bypass Clerk protection.
    if (isPublicPath(request.nextUrl.pathname)) {
      return;
    }

    const { userId } = await auth();
    if (userId) {
      return;
    }

    if (
      request.nextUrl.pathname.startsWith("/api") ||
      acceptsJsonOverHtml(request.headers.get("accept"))
    ) {
      return NextResponse.json({ error: "Unauthenticated" }, { status: 401 });
    }

    const destination = `${request.nextUrl.pathname}${request.nextUrl.search}`;
    const unauthenticatedUrl = new URL("/sign-in", request.url);
    unauthenticatedUrl.searchParams.set(
      "redirect_url",
      sanitizeRedirectUrl(destination)
    );

    return NextResponse.redirect(unauthenticatedUrl);
  },
  {
    // This workstation's clock is currently about 49 seconds slow. Keep the
    // temporary tolerance local-only; production retains Clerk's strict default.
    clockSkewInMs:
      process.env.NODE_ENV === "development"
        ? DEVELOPMENT_CLOCK_SKEW_IN_MS
        : undefined,
  }
);

// Next parses `config` statically at compile time, so it must be exported inline —
// a re-export from a trailing `export { ... }` statement fails the build.
export const config = {
  matcher: [
    /*
     * Match all request paths except:
     * - Next.js internals
     * - common static files, unless they are explicitly requested via search params
     */
    "/((?!_next|robots\\.txt|sitemap\\.xml|favicon\\.ico|opengraph-image.*|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)",
    "/(api|trpc)(.*)",
  ],
};

export { proxy };