import { NextRequest, NextResponse } from 'next/server';

/**
 * Auth gating only.
 *
 * Previously this also generated a per-request nonce and set a strict
 * Content-Security-Policy header. That broke first-paint in production
 * (Next 14.2.x): the bootstrap inline scripts in SSR'd HTML weren't
 * picking up the nonce from `x-nonce` reliably, and the resulting
 * CSP-blocked script left a blank page.
 *
 * Reverted to: middleware does auth gating, CSP is set statically in
 * next.config.js with `'unsafe-inline'` allowed for script + style.
 * That's the same posture we shipped successfully through v1.0.0:1's
 * first cutover smoke build before this experiment.
 *
 * Re-attempt path (later): use Next's documented nonce middleware
 * pattern verbatim, including setting the CSP on BOTH request headers
 * and response headers (the example in
 * https://nextjs.org/docs/app/building-your-application/configuring/content-security-policy
 * sets it on both — we only set it on response, which may be the
 * miss). Test in a real browser before shipping.
 */
export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;
  const sessionToken = request.cookies.get('sessionToken')?.value;

  if (pathname.startsWith('/main') && !sessionToken) {
    return NextResponse.redirect(new URL('/auth/login', request.url));
  }

  if (pathname.startsWith('/api')) {
    if (
      pathname.startsWith('/api/auth') ||
      pathname.startsWith('/api/health')
    ) {
      return NextResponse.next();
    }
    if (!sessionToken) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/main/:path*', '/api/:path*'],
};
