middleware.ts

import type { NextFetchEvent, NextRequest } from "next/server";
import { NextResponse } from "next/server";
import type { NextRequestWithAuth } from "next-auth/middleware";
import { withAuth } from "next-auth/middleware";

import { isLoginBypassed } from "@/lib/config";
import { checkRateLimit } from "@/lib/security/rate-limit";

const authMiddleware = withAuth({
  pages: {
    signIn: "/sign-in",
  },
});

const MIDDLEWARE_RATE_LIMIT = {
  capacity: 120,
  refillRatePerSec: 4,
};

function getMiddlewareKey(request: NextRequest): string {
  const forwarded = request.headers.get("x-forwarded-for");
  if (forwarded) {
    const first = forwarded.split(",")[0]?.trim();
    if (first) {
      return `mw:${first}`;
    }
  }
  const realIp = request.headers.get("x-real-ip");
  if (realIp) {
    return `mw:${realIp.trim()}`;
  }
  return "mw:unknown";
}

export default function middleware(request: NextRequest, event: NextFetchEvent) {
  const outcome = checkRateLimit(getMiddlewareKey(request), MIDDLEWARE_RATE_LIMIT);
  if (!outcome.allowed) {
    return new NextResponse(
      JSON.stringify({ error: "Rate limit exceeded." }),
      {
        status: 429,
        headers: {
          "Content-Type": "application/json",
          "Retry-After": String(outcome.retryAfterSec),
        },
      },
    );
  }

  if (isLoginBypassed()) {
    return NextResponse.next();
  }

  return authMiddleware(request as NextRequestWithAuth, event);
}

export const config = {
  matcher: ["/admin/:path*"],
};