import { NextResponse, type NextRequest } from "next/server";

const PUBLIC = new Set(["/login", "/manifest.webmanifest", "/sw.js", "/api/auth/login", "/api/health", "/offline"]);

export function proxy(req: NextRequest) {
  const { pathname } = req.nextUrl;
  if (PUBLIC.has(pathname) || pathname.startsWith("/_next") || pathname.startsWith("/icons") || pathname === "/favicon.ico") return NextResponse.next();
  const has = req.cookies.get("csa_session")?.value;
  if (!has) {
    if (pathname.startsWith("/api/")) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
    const url = req.nextUrl.clone(); url.pathname = "/login"; url.searchParams.set("next", pathname);
    return NextResponse.redirect(url);
  }
  const res = NextResponse.next();
  res.headers.set("Cache-Control", "private, no-store");
  return res;
}

export const config = { matcher: ["/((?!_next/static|_next/image).*)"] };