80 lines
2.3 KiB
TypeScript
80 lines
2.3 KiB
TypeScript
// middleware.ts
|
|
import { createServerClient } from '@supabase/ssr'
|
|
import { NextResponse, type NextRequest } from 'next/server'
|
|
import { ROLE_HOME, isValidRole, type UserRole } from '@/lib/auth/roles'
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
let supabaseResponse = NextResponse.next({ request })
|
|
|
|
const supabase = createServerClient(
|
|
process.env.NEXT_PUBLIC_SUPABASE_URL!,
|
|
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
|
|
{
|
|
cookies: {
|
|
getAll() {
|
|
return request.cookies.getAll()
|
|
},
|
|
setAll(cookiesToSet) {
|
|
cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value))
|
|
supabaseResponse = NextResponse.next({ request })
|
|
cookiesToSet.forEach(({ name, value, options }) =>
|
|
supabaseResponse.cookies.set(name, value, options),
|
|
)
|
|
},
|
|
},
|
|
},
|
|
)
|
|
|
|
const {
|
|
data: { user },
|
|
} = await supabase.auth.getUser()
|
|
|
|
const { pathname } = request.nextUrl
|
|
const isPublicRoute = pathname.startsWith('/login') || pathname.startsWith('/auth')
|
|
|
|
// Unauthenticated → force login
|
|
if (!user && !isPublicRoute) {
|
|
return NextResponse.redirect(new URL('/login', request.url))
|
|
}
|
|
|
|
// Authenticated + hitting root or login → redirect to role home
|
|
if (user && (pathname === '/' || pathname === '/login')) {
|
|
const { data: profile } = await supabase
|
|
.from('users')
|
|
.select('role')
|
|
.eq('id', user.id)
|
|
.single()
|
|
|
|
const role = profile?.role
|
|
if (isValidRole(role)) {
|
|
return NextResponse.redirect(new URL(ROLE_HOME[role as UserRole], request.url))
|
|
}
|
|
}
|
|
|
|
// Role-based route enforcement for protected paths
|
|
if (user && !isPublicRoute && pathname !== '/') {
|
|
const { data: profile } = await supabase
|
|
.from('users')
|
|
.select('role')
|
|
.eq('id', user.id)
|
|
.single()
|
|
|
|
const role = profile?.role
|
|
if (isValidRole(role)) {
|
|
const allowedPrefix = ROLE_HOME[role as UserRole]
|
|
// Block access to routes that don't belong to this role
|
|
if (!pathname.startsWith(allowedPrefix)) {
|
|
return NextResponse.redirect(new URL(allowedPrefix, request.url))
|
|
}
|
|
}
|
|
}
|
|
|
|
return supabaseResponse
|
|
}
|
|
|
|
export const config = {
|
|
matcher: [
|
|
'/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
|
|
],
|
|
}
|