From 706a075d735a84a4ae7034db62e5dc97eabe2389 Mon Sep 17 00:00:00 2001
From: weeihan <whyap79@gmail.com>
Date: Sun, 12 Jul 2026 14:39:01 +0800
Subject: [PATCH] fix: use nextUrl.clone() for middleware redirects to preserve
 basePath /ims

---
 middleware.ts | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/middleware.ts b/middleware.ts
index b779412..26cc074 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -28,7 +28,8 @@ export async function middleware(request: NextRequest) {
   const isSharedRoute = pathname.startsWith('/report')
 
   if (!user && !isPublicRoute) {
-    const redirectUrl = new URL('/login', request.url)
+    const redirectUrl = request.nextUrl.clone()
+    redirectUrl.pathname = '/login'
     redirectUrl.searchParams.set('redirect', pathname + request.nextUrl.search)
     return NextResponse.redirect(redirectUrl)
   }
@@ -36,11 +37,18 @@ export async function middleware(request: NextRequest) {
   if (user && (pathname === '/' || pathname === '/login')) {
     const redirect = request.nextUrl.searchParams.get('redirect')
     if (redirect && redirect.startsWith('/')) {
-      return NextResponse.redirect(new URL(redirect, request.url))
+      const url = request.nextUrl.clone()
+      url.pathname = redirect
+      url.search = ''
+      return NextResponse.redirect(url)
     }
     const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
     const role = profile?.role
-    if (isValidRole(role)) return NextResponse.redirect(new URL(ROLE_HOME[role as UserRole], request.url))
+    if (isValidRole(role)) {
+      const url = request.nextUrl.clone()
+      url.pathname = ROLE_HOME[role as UserRole]
+      return NextResponse.redirect(url)
+    }
   }
 
   if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
@@ -49,7 +57,9 @@ export async function middleware(request: NextRequest) {
     if (isValidRole(role)) {
       const allowedPrefix = ROLE_HOME[role as UserRole]
       if (!pathname.startsWith(allowedPrefix)) {
-        return NextResponse.redirect(new URL(allowedPrefix, request.url))
+        const url = request.nextUrl.clone()
+        url.pathname = allowedPrefix
+        return NextResponse.redirect(url)
       }
     }
   }