import { NextResponse, type NextRequest } from "next/server";

// From @/lib/auth/cookie, NOT @/lib/pb/server. Middleware runs on the Edge
// runtime, where `server-only` and `next/headers` do not exist.
import { AUTH_COOKIE } from "@/lib/auth/cookie";

/**
 * A coarse redirect for signed-out visitors, nothing more.
 *
 * It checks only that a cookie is present — it does not validate the token and
 * must never be relied on for authorization. Every route handler and page
 * re-checks the session itself. Middleware runs before the request reaches
 * them and is the wrong place to make security decisions.
 */
export function middleware(request: NextRequest) {
  const hasAuth = request.cookies.has(AUTH_COOKIE);

  if (!hasAuth) {
    const url = request.nextUrl.clone();
    url.pathname = "/login";
    return NextResponse.redirect(url);
  }

  return NextResponse.next();
}

export const config = {
  matcher: ["/", "/p/:path*", "/plan", "/admin/:path*"],
};