proxy.ts

import { auth } from '@/auth';
import { NextResponse } from 'next/server';

export const proxy = auth((req) => {
  const isLoggedIn = !!req.auth;
  const path = req.nextUrl.pathname;
  const isLoginPage = path === '/login';
  const isPublicPage =
    path === '/' || path.startsWith('/verify') || path === '/site.webmanifest';

  // Allow everyone (logged in or out) to access the public root page and verify pages
  if (isPublicPage) {
    return NextResponse.next();
  }

  // If not logged in and trying to access a protected page
  if (!isLoggedIn && !isLoginPage) {
    return NextResponse.redirect(new URL('/login', req.url));
  }

  // If logged in and trying to access the login page
  if (isLoggedIn && isLoginPage) {
    return NextResponse.redirect(new URL('/dashboard', req.url));
  }

  // Role-based protection
  if (isLoggedIn) {
    const role = req.auth?.user?.role;
    const isRestrictedRoute =
      path.startsWith('/users') ||
      path.startsWith('/settings') ||
      path.startsWith('/audit');

    if (role === 'Volunteer' && isRestrictedRoute) {
      return NextResponse.redirect(new URL('/dashboard', req.url));
    }
  }

  return NextResponse.next();
});

export const config = {
  matcher: [
    '/((?!api|_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|webmanifest|json)$).*)',
  ],
};