proxy.ts

import { getSessionCookie } from "better-auth/cookies";
import { type NextRequest, NextResponse } from "next/server";
import createMiddleware from "next-intl/middleware";

import { routing } from "@/i18n/routing";
import { AUTH_ROUTE_KEYS, PUBLIC_ROUTE_KEYS } from "@/lib/auth/route-access";
import {
  extractLocale,
  getAllLocalizedPaths,
  stripLocalePrefix,
} from "@/lib/i18n-utils";
import { buildCspHeader } from "@/lib/security/csp";

const intlMiddleware = createMiddleware(routing);

/** All localized variants, pre-computed at module load. */
const authRoutes = AUTH_ROUTE_KEYS.flatMap(getAllLocalizedPaths);
const publicRoutes = PUBLIC_ROUTE_KEYS.flatMap(getAllLocalizedPaths);

const securityHeaders: Record<string, string> = {
  "Strict-Transport-Security": "max-age=63072000; includeSubDomains; preload",
  "X-Content-Type-Options": "nosniff",
  "X-Frame-Options": "DENY",
  "Referrer-Policy": "strict-origin-when-cross-origin",
  "Permissions-Policy":
    "camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(), browsing-topics=()",
};

function applyHeaders(
  response: NextResponse,
  cspHeader?: string,
): NextResponse {
  for (const [key, value] of Object.entries(securityHeaders)) {
    response.headers.set(key, value);
  }
  if (cspHeader) {
    response.headers.set("Content-Security-Policy", cspHeader);
  }
  return response;
}

export function proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;
  const isDev = process.env.NODE_ENV === "development";

  // API routes: security headers only (no CSP, no i18n)
  if (pathname.startsWith("/api")) {
    return applyHeaders(NextResponse.next());
  }

  // Generate nonce + CSP (production only)
  const nonce = isDev
    ? ""
    : Buffer.from(crypto.randomUUID()).toString("base64");
  const cspHeader = isDev ? "" : buildCspHeader(nonce);

  // Auth check: redirect unauthenticated users on protected routes,
  // and redirect authenticated users away from sign-in/sign-up pages.
  const pathnameWithoutLocale = stripLocalePrefix(pathname);
  const isAuthRoute = authRoutes.some((route) =>
    pathnameWithoutLocale.startsWith(route),
  );
  const isPublicRouteKey = publicRoutes.some((route) =>
    pathnameWithoutLocale.startsWith(route),
  );
  const isPublicRoute =
    pathnameWithoutLocale === "/" || isAuthRoute || isPublicRouteKey;
  const hasSession = !!getSessionCookie(request, { cookiePrefix: "avisio" });

  if (isAuthRoute && hasSession) {
    const locale = extractLocale(pathname);
    return applyHeaders(
      NextResponse.redirect(new URL(`/${locale}`, request.url)),
      cspHeader,
    );
  }

  if (!isPublicRoute && !hasSession) {
    const locale = extractLocale(pathname);
    return applyHeaders(
      NextResponse.redirect(new URL(`/${locale}/anmelden`, request.url)),
      cspHeader,
    );
  }

  // i18n routing
  const intlResponse = intlMiddleware(request);

  // Redirects: add headers and return directly
  if (intlResponse.headers.get("location")) {
    return applyHeaders(intlResponse, cspHeader);
  }

  // Page responses: merge intl middleware's forwarded request headers with our
  // nonce headers. Next.js uses x-middleware-override-headers (comma-separated
  // list of header names) + x-middleware-request-<name> (values) to forward
  // request headers from middleware to server components.
  // We must merge both sets so i18n AND nonce forwarding work together.
  const intlOverrides =
    intlResponse.headers.get("x-middleware-override-headers") ?? "";
  const headerNames = intlOverrides
    ? intlOverrides.split(",").map((h) => h.trim())
    : [];

  // Add our nonce headers to the forwarded set
  if (!isDev) {
    headerNames.push("x-nonce", "content-security-policy");
  }

  const requestHeaders = new Headers(request.headers);

  // Copy intl's forwarded request header values onto our request headers
  for (const name of headerNames) {
    const intlValue = intlResponse.headers.get(`x-middleware-request-${name}`);
    if (intlValue != null) {
      requestHeaders.set(name, intlValue);
    }
  }

  // Set our nonce values
  if (!isDev) {
    requestHeaders.set("x-nonce", nonce);
    requestHeaders.set("content-security-policy", cspHeader);
  }

  const response = NextResponse.next({
    request: { headers: requestHeaders },
  });

  // Copy intl middleware's response headers (skip x-middleware-override/request-*
  // since NextResponse.next() already encodes our merged request headers)
  for (const [key, value] of intlResponse.headers) {
    if (
      key === "x-middleware-override-headers" ||
      key.startsWith("x-middleware-request-")
    ) {
      continue;
    }
    response.headers.set(key, value);
  }
  for (const cookie of intlResponse.cookies.getAll()) {
    response.cookies.set(cookie);
  }

  return applyHeaders(response, cspHeader);
}

export const config = {
  matcher: ["/((?!ingest|monitoring|_next|_vercel|.*\\..*).*)"],
};