import { getToken } from 'next-auth/jwt';
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { getAuthSecret } from '@/lib/auth-secret';
import { checkRateLimit } from '@/lib/rate-limit';
import { applySecurityHeaders, createCspNonce } from '@/lib/security-headers';

function withNoStore(response: NextResponse) {
  response.headers.set('Cache-Control', 'private, no-store, no-cache, must-revalidate, max-age=0');
  response.headers.set('Pragma', 'no-cache');
  response.headers.set('Expires', '0');
  return response;
}

function finalize(response: NextResponse, request: NextRequest, nonce: string): NextResponse {
  response.headers.set('x-nonce', nonce);
  return applySecurityHeaders(withNoStore(response), request, nonce);
}

export async function middleware(req: NextRequest) {
  const nonce = createCspNonce();
  const requestHeaders = new Headers(req.headers);
  requestHeaders.set('x-nonce', nonce);

  const rateLimited = checkRateLimit(req);
  if (rateLimited) {
    return finalize(rateLimited, req, nonce);
  }

  const { pathname } = req.nextUrl;

  if (pathname.startsWith('/admin') && !pathname.startsWith('/admin/login')) {
    const token = await getToken({ req, secret: getAuthSecret() });
    if (!token || token.role !== 'admin') {
      const url = req.nextUrl.clone();
      url.pathname = '/admin/login/';
      return finalize(NextResponse.redirect(url), req, nonce);
    }
  }

  return finalize(NextResponse.next({ request: { headers: requestHeaders } }), req, nonce);
}

export const config = {
  matcher: [
    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|woff2?)$).*)',
  ],
};