63 lines
2.3 KiB
TypeScript
63 lines
2.3 KiB
TypeScript
import { createServerClient } from '@supabase/ssr'
|
|
import { NextResponse, type NextRequest } from 'next/server'
|
|
import { ROLE_HOME, isValidRole, type UserRole } from '@/lib/auth/roles'
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
let supabaseResponse = NextResponse.next({ request })
|
|
|
|
const supabase = createServerClient(
|
|
process.env.NEXT_PUBLIC_SUPABASE_URL!,
|
|
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
|
|
{
|
|
cookies: {
|
|
getAll() { return request.cookies.getAll() },
|
|
setAll(cookiesToSet) {
|
|
cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value))
|
|
supabaseResponse = NextResponse.next({ request })
|
|
cookiesToSet.forEach(({ name, value, options }) =>
|
|
supabaseResponse.cookies.set(name, value, options),
|
|
)
|
|
},
|
|
},
|
|
},
|
|
)
|
|
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
const { pathname } = request.nextUrl
|
|
const isPublicRoute = pathname.startsWith('/login') || pathname.startsWith('/auth')
|
|
const isSharedRoute = pathname.startsWith('/report')
|
|
|
|
if (!user && !isPublicRoute) {
|
|
const redirectUrl = new URL('/login', request.url)
|
|
redirectUrl.searchParams.set('redirect', pathname + request.nextUrl.search)
|
|
return NextResponse.redirect(redirectUrl)
|
|
}
|
|
|
|
if (user && (pathname === '/' || pathname === '/login')) {
|
|
const redirect = request.nextUrl.searchParams.get('redirect')
|
|
if (redirect && redirect.startsWith('/')) {
|
|
return NextResponse.redirect(new URL(redirect, request.url))
|
|
}
|
|
const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
|
|
const role = profile?.role
|
|
if (isValidRole(role)) return NextResponse.redirect(new URL(ROLE_HOME[role as UserRole], request.url))
|
|
}
|
|
|
|
if (user && !isPublicRoute && !isSharedRoute && pathname !== '/') {
|
|
const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
|
|
const role = profile?.role
|
|
if (isValidRole(role)) {
|
|
const allowedPrefix = ROLE_HOME[role as UserRole]
|
|
if (!pathname.startsWith(allowedPrefix)) {
|
|
return NextResponse.redirect(new URL(allowedPrefix, request.url))
|
|
}
|
|
}
|
|
}
|
|
|
|
return supabaseResponse
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)'],
|
|
}
|