import { NextRequest, NextResponse } from 'next/server'
import createMiddleware from 'next-intl/middleware'
import NextAuth from 'next-auth'
import { authConfig } from '@/lib/auth.config'
import { routing } from '@/i18n/routing'

// Edge-safe session read only — the Prisma-backed provider in lib/auth.ts
// cannot run in the middleware's Edge runtime, so this uses the bare config.
const { auth } = NextAuth(authConfig)
const intlMiddleware = createMiddleware(routing)

export async function proxy(request: NextRequest) {
  if (request.nextUrl.pathname.includes('/admin')) {
    const session = await auth()
    if (!session || (session.user as any)?.role !== 'ADMIN') {
      return NextResponse.redirect(new URL('/login', request.url))
    }
  }
  request.headers.set('x-pathname', request.nextUrl.pathname)
  return intlMiddleware(request)
}

export const config = {
  // icon / apple-icon are root-level, locale-independent metadata routes
  // (app/icon.tsx, app/apple-icon.tsx) — without this exclusion the intl
  // middleware treats them as un-prefixed pages and redirects them to
  // /tr/icon, which 404s and breaks the favicon/apple-touch-icon.
  matcher: ['/((?!api|_next|_vercel|icon|apple-icon|.*\\..*).*)']
}