spb/polyllm

1import { NextResponse, type NextRequest } from "next/server";23/**4 * Edge-light routing guard: redirects unauthenticated visitors away from /app and /admin5 * based on the presence of the session cookie. Real verification happens server-side in6 * `requireUser()`; this only avoids a flash of protected UI.7 */8export function proxy(req: NextRequest) {9  const { pathname } = req.nextUrl;10  const hasSession = req.cookies.getAll().some((c) => /polyllm.*session_token/.test(c.name));11  if ((pathname.startsWith("/app") || pathname.startsWith("/admin")) && !hasSession) {12    const url = req.nextUrl.clone();13    url.pathname = "/login";14    url.searchParams.set("next", pathname);15    return NextResponse.redirect(url);16  }17  if ((pathname === "/login" || pathname === "/signup") && hasSession) {18    // A stale/revoked session cookie: `requireUser()` sent the visitor here with ?expired=1.19    // Clear the cookies and show the login page instead of bouncing back to /app forever.20    if (req.nextUrl.searchParams.has("expired")) {21      const res = NextResponse.next();22      for (const c of req.cookies.getAll()) if (/polyllm.*session/.test(c.name)) res.cookies.delete(c.name);23      return res;24    }25    const url = req.nextUrl.clone();26    url.pathname = "/app/chat";27    url.search = "";28    return NextResponse.redirect(url);29  }30  return NextResponse.next();31}3233export const config = {34  matcher: ["/app/:path*", "/admin/:path*", "/login", "/signup"],35};36