feat: incident report form, API route, middleware shared-route + redirect

middleware.ts

@@ -1,4 +1,3 @@
-// middleware.ts
 import { createServerClient } from '@supabase/ssr'
 import { NextResponse, type NextRequest } from 'next/server'
 import { ROLE_HOME, isValidRole, type UserRole } from '@/lib/auth/roles'
@@ -11,9 +10,7 @@ export async function middleware(request: NextRequest) {
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
       cookies: {
-        getAll() {
-          return request.cookies.getAll()
-        },
+        getAll() { return request.cookies.getAll() },
         setAll(cookiesToSet) {
           cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value))
           supabaseResponse = NextResponse.next({ request })
@@ -25,44 +22,32 @@ export async function middleware(request: NextRequest) {
     },
   )
 
-  const {
-    data: { user },
-  } = await supabase.auth.getUser()
-
+  const { data: { user } } = await supabase.auth.getUser()
   const { pathname } = request.nextUrl
   const isPublicRoute = pathname.startsWith('/login') || pathname.startsWith('/auth')
+  const isSharedRoute = pathname.startsWith('/report')
 
-  // Unauthenticated → force login
   if (!user && !isPublicRoute) {
-    return NextResponse.redirect(new URL('/login', request.url))
+    const redirectUrl = new URL('/login', request.url)
+    redirectUrl.searchParams.set('redirect', pathname + request.nextUrl.search)
+    return NextResponse.redirect(redirectUrl)
   }
 
-  // Authenticated + hitting root or login → redirect to role home
   if (user && (pathname === '/' || pathname === '/login')) {
-    const { data: profile } = await supabase
-      .from('users')
-      .select('role')
-      .eq('id', user.id)
-      .single()
-
-    const role = profile?.role
-    if (isValidRole(role)) {
-      return NextResponse.redirect(new URL(ROLE_HOME[role as UserRole], request.url))
+    const redirect = request.nextUrl.searchParams.get('redirect')
+    if (redirect && redirect.startsWith('/')) {
+      return NextResponse.redirect(new URL(redirect, request.url))
     }
+    const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
+    const role = profile?.role
+    if (isValidRole(role)) return NextResponse.redirect(new URL(ROLE_HOME[role as UserRole], request.url))
   }
 
-  // Role-based route enforcement for protected paths
-  if (user && !isPublicRoute && pathname !== '/') {
-    const { data: profile } = await supabase
-      .from('users')
-      .select('role')
-      .eq('id', user.id)
-      .single()
-
+  if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
+    const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
     const role = profile?.role
     if (isValidRole(role)) {
       const allowedPrefix = ROLE_HOME[role as UserRole]
-      // Block access to routes that don't belong to this role
       if (!pathname.startsWith(allowedPrefix)) {
         return NextResponse.redirect(new URL(allowedPrefix, request.url))
       }
@@ -73,7 +58,5 @@ export async function middleware(request: NextRequest) {
 }
 
 export const config = {
-  matcher: [
-    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
-  ],
+  matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)'],
 }