import { auth } from '@/auth';
import { NextResponse } from 'next/server';

const protectedApiPrefixes = ['/api/products', '/api/organizations', '/api/users'];
const superAdminOnlyRoutes = ['/dashboard/workspaces'];
const organizationAdminRoutes = ['/dashboard/users', '/dashboard/workspaces/team'];

export default auth((req) => {
  const pathname = req.nextUrl.pathname;
  const isDashboardRoute = pathname.startsWith('/dashboard');
  const isProtectedApiRoute = protectedApiPrefixes.some((prefix) => pathname.startsWith(prefix));
  const user = req.auth?.user;
  const isSignedIn = !!user;
  const isSuperAdmin = user?.systemRole === 'super_admin';
  const isOrganizationAdmin =
    isSuperAdmin ||
    (user?.activeOrganizationId &&
      (user.activeMembershipRole === 'admin' || user.activePermissions?.includes('users:manage')));

  if (!isSignedIn && (isDashboardRoute || isProtectedApiRoute)) {
    if (isProtectedApiRoute) {
      return NextResponse.json({ message: 'Unauthorized' }, { status: 401 });
    }

    const signInUrl = new URL('/auth/sign-in', req.nextUrl.origin);
    signInUrl.searchParams.set('callbackUrl', pathname);
    return NextResponse.redirect(signInUrl);
  }

  if (
    isSignedIn &&
    superAdminOnlyRoutes.some((prefix) => pathname.startsWith(prefix)) &&
    !isSuperAdmin
  ) {
    return NextResponse.redirect(new URL('/dashboard', req.nextUrl.origin));
  }

  if (
    isSignedIn &&
    organizationAdminRoutes.some((prefix) => pathname.startsWith(prefix)) &&
    !isOrganizationAdmin
  ) {
    return NextResponse.redirect(new URL('/dashboard', req.nextUrl.origin));
  }

  return NextResponse.next();
});

export const config = {
  matcher: [
    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
    '/(api|trpc)(.*)'
  ]
};
