1import { NextResponse, type NextRequest } from "next/server";23/**4 * Edge-light routing guard: redirects unauthenticated visitors away from /app and /admin5 * based on the presence of the session cookie. Real verification happens server-side in6 * `requireUser()`; this only avoids a flash of protected UI.7 */8export function proxy(req: NextRequest) {9 const { pathname } = req.nextUrl;10 const hasSession = req.cookies.getAll().some((c) => /polyllm.*session_token/.test(c.name));11 if ((pathname.startsWith("/app") || pathname.startsWith("/admin")) && !hasSession) {12 const url = req.nextUrl.clone();13 url.pathname = "/login";14 url.searchParams.set("next", pathname);15 return NextResponse.redirect(url);16 }17 if ((pathname === "/login" || pathname === "/signup") && hasSession) {18 const url = req.nextUrl.clone();19 url.pathname = "/app/chat";20 url.search = "";21 return NextResponse.redirect(url);22 }23 return NextResponse.next();24}2526export const config = {27 matcher: ["/app/:path*", "/admin/:path*", "/login", "/signup"],28};29