middleware.ts

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
import NextAuth from "next-auth";

import { authConfig } from "@/lib/auth/auth.config";

const { auth } = NextAuth(authConfig);

export default auth(async function middleware(req: NextRequest & { auth: { user?: unknown } | null }) {
  const { pathname } = req.nextUrl;

  // Admin API routes: require ADMIN role
  if (pathname.startsWith("/api/admin")) {
    const role = (req.auth as { user?: { role?: string } } | null)?.user?.role;
    if (role !== "ADMIN") {
      return NextResponse.json({ data: null, error: "FORBIDDEN" }, { status: 403 });
    }
    return NextResponse.next();
  }

  // Skip auth processing for all other API routes
  if (pathname.startsWith("/api/")) {
    return NextResponse.next();
  }

  // Admin page routes: non-admin users get a 403 response
  if (pathname.startsWith("/admin")) {
    const role = (req.auth as { user?: { role?: string } } | null)?.user?.role;
    if (role !== "ADMIN") {
      return new NextResponse("Forbidden", { status: 403 });
    }
  }

  return NextResponse.next();
});

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico|.*\\..*).*)"],
};