dow-prod-tracker/src/middleware.ts

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

function safeCompare(a: string, b: string): boolean {
  if (a.length !== b.length) return false;
  // Note: Edge runtime may not have crypto.timingSafeEqual,
  // so we use a constant-time comparison loop as fallback
  let result = 0;
  for (let i = 0; i < a.length; i++) {
    result |= a.charCodeAt(i) ^ b.charCodeAt(i);
  }
  return result === 0;
}

export function middleware(request: NextRequest) {
  // Dev bypass: skip all auth checks for local testing.
  // Safety: only honoured when Entra ID credentials are NOT configured,
  // preventing accidental bypass in production.
  if (
    process.env.DEV_BYPASS_AUTH === "true" &&
    process.env.NODE_ENV !== "production"
  ) {
    return NextResponse.next();
  }

  const { pathname } = request.nextUrl;

  // API key auth: allow external API access with X-API-Key header
  if (pathname.startsWith("/api/") && process.env.API_KEY) {
    const apiKey = request.headers.get("x-api-key");
    if (apiKey && safeCompare(apiKey, process.env.API_KEY)) {
      return NextResponse.next();
    }
  }

  const isAuthPage =
    pathname.startsWith("/login") ||
    pathname.startsWith("/forgot-password") ||
    pathname.startsWith("/reset-password");
  const isPendingPage = pathname.startsWith("/pending");
  const isApiAuth = pathname.startsWith("/api/auth");
  // Local-auth endpoints live under /api/local-auth/ to avoid colliding with
  // NextAuth's [...nextauth] catch-all. forgot-password and reset-password are
  // accessible without a session; login is obviously pre-session.
  const isLocalAuth = pathname.startsWith("/api/local-auth/");
  const isHealthCheck = pathname === "/api/health";
  // Webhooks are authenticated per-endpoint via HMAC (see /api/webhooks/omg).
  const isWebhook = pathname.startsWith("/api/webhooks/");

  // Always allow auth API routes, health checks, and webhook receivers
  if (isApiAuth || isLocalAuth || isHealthCheck || isWebhook) {
    return NextResponse.next();
  }

  // Check for session cookie (Auth.js database sessions)
  const sessionToken =
    request.cookies.get("authjs.session-token")?.value ||
    request.cookies.get("__Secure-authjs.session-token")?.value;

  const isLoggedIn = !!sessionToken;

  // Redirect logged-in users away from login page
  if (isAuthPage && isLoggedIn) {
    const url = request.nextUrl.clone();
    url.pathname = "/dashboard";
    return NextResponse.redirect(url);
  }

  // Allow authenticated users to access the pending page
  if (isPendingPage && isLoggedIn) {
    return NextResponse.next();
  }

  // Redirect unauthenticated users to login (API routes get 401 JSON instead of redirect)
  if (!isAuthPage && !isLoggedIn) {
    if (pathname.startsWith("/api/")) {
      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
    }
    const url = request.nextUrl.clone();
    url.pathname = "/login";
    return NextResponse.redirect(url);
  }

  return NextResponse.next();
}

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};