import { NextRequest, NextResponse } from 'next/server';
import { verifyAccessToken } from '@/lib/tokens';

/**
 * Centralised auth middleware.
 * – Public routes (auth endpoints, static assets) are skipped.
 * – All other /api/* routes require a valid JWT access token.
 * – Admin routes require admin role.
 * – Pages are handled client-side (page.tsx already checks session).
 * – Automatic token refresh is handled for expired access tokens.
 */

const PUBLIC_API = [
  '/api/auth/signin',
  '/api/auth/signup',
  '/api/auth/signout',
  '/api/auth/session',
  '/api/auth/refresh',
  '/api/auth/github',
  '/api/auth/github/callback',
  '/api/auth/bitbucket',
  '/api/auth/bitbucket/callback',
  '/api/auth/gitlab',
  '/api/auth/gitlab/callback',
  '/api/auth/azure',
  '/api/auth/azure/callback',
  '/api/health',
  '/api/engine',
  '/api/cron/monthly-billing',
  '/api/cron',
  '/api/auth/2fa/verify',
];

export function proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;

  // Only intercept /api/* routes (not pages, static assets, etc.)
  if (!pathname.startsWith('/api/')) {
    return NextResponse.next();
  }

  // Allow public auth endpoints
  if (PUBLIC_API.some((p) => pathname.startsWith(p))) {
    return NextResponse.next();
  }

  // Require access token for all protected API routes
  const accessToken = request.cookies.get('scriba.access_token')?.value;
  if (!accessToken) {
    return NextResponse.json({ error: 'Unauthorized - No access token' }, { status: 401 });
  }

  // Verify access token (fast validation without DB hit)
  const tokenPayload = verifyAccessToken(accessToken);
  if (!tokenPayload) {
    return NextResponse.json({ error: 'Unauthorized - Invalid access token' }, { status: 401 });
  }

  // Admin routes require admin role - let route handler validate role
  // This is a fast-fail gate; route handlers do full DB validation
  return NextResponse.next();
}

export const config = {
  matcher: ['/api/:path*'],
};