66 lines
2.1 KiB
TypeScript
66 lines
2.1 KiB
TypeScript
import { NextResponse } from "next/server"
|
|
import type { NextRequest } from "next/server"
|
|
import { auth } from "@/lib/auth"
|
|
|
|
const authRoutes = [
|
|
"/login",
|
|
"/signup",
|
|
"/forgot-password",
|
|
"/reset-password",
|
|
]
|
|
|
|
const adminRoutes = ["/admin"]
|
|
|
|
export async function proxy(req: NextRequest) {
|
|
const path = req.nextUrl.pathname
|
|
const isAuthRoute = authRoutes.some((route) => path.startsWith(route))
|
|
const isAdminRoute = adminRoutes.some((route) => path.startsWith(route))
|
|
|
|
if (!isAuthRoute && !isAdminRoute) {
|
|
return NextResponse.next()
|
|
}
|
|
|
|
// Allow authenticated users to complete the signup wizard.
|
|
// After signUp.email() creates a session, the wizard needs to stay
|
|
// on /signup to complete OTP verification and passkey setup.
|
|
if (path === "/signup") {
|
|
const step = req.nextUrl.searchParams.get("step")
|
|
if (step === "otp" || step === "passkey") {
|
|
// Wizard step URLs require a valid session (created by signUp.email() in step 1).
|
|
// Without a session, redirect to /signup to prevent URL-guessing bypass.
|
|
const wizardSession = await auth.api.getSession({
|
|
headers: req.headers,
|
|
})
|
|
if (wizardSession) {
|
|
return NextResponse.next()
|
|
}
|
|
return NextResponse.redirect(new URL("/signup", req.url))
|
|
}
|
|
}
|
|
|
|
// Validate session server-side instead of just checking cookie existence.
|
|
// This prevents stale cookies from causing redirect loops.
|
|
const session = await auth.api.getSession({
|
|
headers: req.headers,
|
|
})
|
|
|
|
// Admin routes: require an admin session
|
|
if (isAdminRoute) {
|
|
if (!session || session.user.role !== "admin") {
|
|
return NextResponse.redirect(new URL("/", req.url))
|
|
}
|
|
return NextResponse.next()
|
|
}
|
|
|
|
// Auth routes: redirect authenticated users away
|
|
if (session) {
|
|
return NextResponse.redirect(new URL("/", req.url))
|
|
}
|
|
|
|
return NextResponse.next()
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!api|_next/static|_next/image|.*\\.png$).*)"],
|
|
}
|