spb/social-runtime-crawler

1import { NextResponse, type NextRequest } from "next/server";23/**4 * Edge gate: redirect unauthenticated visitors to /access. Token verification (HMAC) happens in the5 * Node route handlers; here we only check presence + expiry to keep the edge runtime crypto-free.6 */7export function proxy(req: NextRequest) {8  const { pathname } = req.nextUrl;9  if (pathname.startsWith("/access") || pathname.startsWith("/_next") || pathname === "/favicon.ico" || pathname.startsWith("/brand")) return NextResponse.next();10  const gate = process.env.SRC_DASHBOARD_PASSCODE;11  if (!gate) return NextResponse.next();12  const token = req.cookies.get("src_access")?.value;13  const exp = token ? Number(token.split(".")[0]) : 0;14  if (!token || !(exp > Date.now())) {15    if (pathname.startsWith("/api")) return NextResponse.json({ error: "unauthorized" }, { status: 401 });16    const url = req.nextUrl.clone();17    url.pathname = "/access";18    url.searchParams.set("next", pathname);19    return NextResponse.redirect(url);20  }21  return NextResponse.next();22}2324export const config = { matcher: ["/((?!_next/static|_next/image).*)"] };25