Spaces:
Running
Running
| import { NextResponse } from "next/server"; | |
| import type { NextRequest } from "next/server"; | |
| // Paths that don't require authentication | |
| const PUBLIC_PATHS = ["/login", "/signup", "/api/auth"]; | |
| function isPublicPath(pathname: string): boolean { | |
| return PUBLIC_PATHS.some((p) => pathname === p || pathname.startsWith(p + "/")); | |
| } | |
| export function middleware(request: NextRequest) { | |
| const { pathname } = request.nextUrl; | |
| // Allow public paths (login, auth callbacks) | |
| if (isPublicPath(pathname)) { | |
| return NextResponse.next(); | |
| } | |
| // Production-only blocking without explicit config | |
| if (process.env.NODE_ENV === "production") { | |
| const explicitlyEnabled = process.env.ADMIN_ALLOW_PRODUCTION === "true"; | |
| const hasAuth = Boolean( | |
| process.env.BETTER_AUTH_SECRET && process.env.BETTER_AUTH_URL, | |
| ); | |
| if (!explicitlyEnabled || !hasAuth) { | |
| return new NextResponse( | |
| "MicProtocol Admin is not exposed in production without explicit configuration. " + | |
| "Set ADMIN_ALLOW_PRODUCTION=true and configure real authentication to enable it.", | |
| { status: 503 }, | |
| ); | |
| } | |
| } | |
| // Auth gating: check for Better Auth session cookie or dev-mode header | |
| const sessionCookie = request.cookies.get("better-auth.session"); | |
| const devUserId = request.headers.get("x-user-id"); | |
| if (!sessionCookie && !devUserId) { | |
| const loginUrl = new URL("/login", request.url); | |
| loginUrl.searchParams.set("callbackUrl", pathname); | |
| return NextResponse.redirect(loginUrl); | |
| } | |
| return NextResponse.next(); | |
| } | |
| export const config = { | |
| matcher: ["/((?!_next|.*\\..*).*)"], | |
| }; | |