proxy.ts

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
import { jwtVerify } from "jose";
import { prisma } from "@/lib/prisma";

const PROTECTED_PREFIXES = ["/dashboard", "/admin"];
const AUTH_PAGES = ["/login", "/registro", "/recuperar"];
const COOKIE_NAME = "plc_session";

function getSecret() {
  const raw = process.env.AUTH_SECRET?.trim();
  if (!raw) return null;
  return new TextEncoder().encode(raw);
}

async function verifySessionJwt(token: string): Promise<{ sub: string; sid: string } | null> {
  const secret = getSecret();
  if (!secret) return null;
  try {
    const { payload } = await jwtVerify(token, secret);
    if (!payload.sub || typeof payload.sid !== "string") return null;
    return { sub: payload.sub as string, sid: payload.sid };
  } catch {
    return null;
  }
}

// Node.js runtime — can hit the DB to verify session still exists
async function isActiveSession(token: string): Promise<boolean> {
  const payload = await verifySessionJwt(token);
  if (!payload) return false;

  try {
    const session = await prisma.session.findUnique({
      where: { id: payload.sid },
      select: { expires_at: true, user: { select: { is_active: true } } },
    });
    if (!session || session.expires_at < new Date()) return false;
    if (!session.user?.is_active) return false;
    return true;
  } catch {
    // DB unavailable — fall back to JWT-only validation
    return true;
  }
}

export async function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;
  const sessionCookie = request.cookies.get(COOKIE_NAME)?.value;

  const isProtected = PROTECTED_PREFIXES.some((prefix) => pathname.startsWith(prefix));
  const isAuthPage = AUTH_PAGES.some((page) => pathname.startsWith(page));

  if (isProtected) {
    if (!sessionCookie) {
      const loginUrl = new URL("/login", request.url);
      loginUrl.searchParams.set("next", pathname);
      return NextResponse.redirect(loginUrl);
    }
    const valid = await isActiveSession(sessionCookie);
    if (!valid) {
      const loginUrl = new URL("/login", request.url);
      loginUrl.searchParams.set("next", pathname);
      const res = NextResponse.redirect(loginUrl);
      res.cookies.set(COOKIE_NAME, "", { path: "/", maxAge: 0 });
      return res;
    }
  }

  if (isAuthPage && sessionCookie) {
    const payload = await verifySessionJwt(sessionCookie);
    if (payload) {
      return NextResponse.redirect(new URL("/dashboard", request.url));
    }
    // Invalid/expired cookie — clear it and let them stay on the auth page
    const response = NextResponse.next();
    response.cookies.set(COOKIE_NAME, "", { path: "/", maxAge: 0 });
    return response;
  }

  return NextResponse.next();
}

export const config = {
  matcher: ["/dashboard/:path*", "/admin/:path*", "/login", "/registro", "/recuperar"],
};