import { NextResponse, type NextRequest } from "next/server";

/**
 * Edge gate: redirect unauthenticated visitors to /access. Token verification (HMAC) happens in the
 * Node route handlers; here we only check presence + expiry to keep the edge runtime crypto-free.
 */
export function proxy(req: NextRequest) {
  const { pathname } = req.nextUrl;
  if (pathname.startsWith("/access") || pathname.startsWith("/_next") || pathname === "/favicon.ico" || pathname.startsWith("/brand")) return NextResponse.next();
  const gate = process.env.SRC_DASHBOARD_PASSCODE;
  if (!gate) return NextResponse.next();
  const token = req.cookies.get("src_access")?.value;
  const exp = token ? Number(token.split(".")[0]) : 0;
  if (!token || !(exp > Date.now())) {
    if (pathname.startsWith("/api")) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
    const url = req.nextUrl.clone();
    url.pathname = "/access";
    url.searchParams.set("next", pathname);
    return NextResponse.redirect(url);
  }
  return NextResponse.next();
}

export const config = { matcher: ["/((?!_next/static|_next/image).*)"] };