frontend/src/middleware.ts

import { auth } from "@/auth";
import { NextResponse } from "next/server";

// Public routes that don't require authentication
const publicRoutes = ["/login", "/signup", "/forgot-password", "/reset-password", "/verify-email"];

export default auth((req) => {
  const { nextUrl } = req;
  const isLoggedIn = !!req.auth;

  const isPublicRoute = publicRoutes.some(
    (route) => nextUrl.pathname === route || nextUrl.pathname.startsWith(route + "/")
  );

  const isApiRoute = nextUrl.pathname.startsWith("/api");
  const isStaticRoute = nextUrl.pathname.startsWith("/_next") ||
                        nextUrl.pathname.startsWith("/assets") ||
                        nextUrl.pathname.includes(".");

  // Skip middleware for API routes and static files
  if (isApiRoute || isStaticRoute) {
    return NextResponse.next();
  }

  // Redirect logged-in users away from public routes (login, signup)
  if (isLoggedIn && isPublicRoute) {
    return NextResponse.redirect(new URL("/", nextUrl.origin));
  }

  // Redirect non-logged-in users to login page for protected routes
  if (!isLoggedIn && !isPublicRoute) {
    const loginUrl = new URL("/login", nextUrl.origin);
    loginUrl.searchParams.set("callbackUrl", nextUrl.pathname);
    return NextResponse.redirect(loginUrl);
  }

  return NextResponse.next();
});

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};