proxy.ts

import { NextResponse } from "next/server";
import { auth } from "@/lib/auth/auth-options";

// Named `proxy` (not `middleware`) per the Next.js 16 rename -- see
// node_modules/next/dist/docs/01-app/03-api-reference/03-file-conventions/proxy.md
const PROTECTED_PAGE_PREFIXES = ["/dashboard"];
const PROTECTED_API_PREFIXES = ["/api/query", "/api/history", "/api/datasets"];

export const proxy = auth((req) => {
  const { pathname } = req.nextUrl;
  if (req.auth) return;

  // API routes must return JSON, never an HTML redirect -- a 307 to /login
  // would otherwise be the first thing any API client (or the smoke test)
  // sees instead of a 401.
  if (PROTECTED_API_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  if (PROTECTED_PAGE_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {
    const loginUrl = new URL("/login", req.nextUrl);
    loginUrl.searchParams.set("callbackUrl", pathname);
    return NextResponse.redirect(loginUrl);
  }
});

export const config = {
  matcher: ["/dashboard/:path*", "/api/query/:path*", "/api/history/:path*", "/api/datasets/:path*"],
};