import { NextRequest, NextResponse } from "next/server";
import { getSessionCookie } from "better-auth/cookies";

const PUBLIC_ROUTES = ["/login", "/register", "/verify-email", "/forgot-password", "/reset-password", "/api/auth", "/api/register", "/api/internal", "/maintenance", "/share/wrapped"];

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;

  // Прямой Better Auth sign-up обходит Turnstile/honeypot-обёртку
  // (/api/register) — наружу закрыт. Сама регистрация не страдает:
  // /api/register вызывает auth.handler программно, минуя middleware.
  if (pathname.startsWith("/api/auth/sign-up")) {
    return new NextResponse(null, { status: 404 });
  }

  if (
    pathname === "/" || // public welcome page; "/" must stay an EXACT match (startsWith would open everything)
    PUBLIC_ROUTES.some((route) => pathname.startsWith(route)) ||
    pathname.startsWith("/_next") ||
    pathname.startsWith("/favicon") ||
    pathname === "/logo.svg"
  ) {
    return NextResponse.next();
  }

  const sessionCookie = getSessionCookie(request);

  if (!sessionCookie) {
    return NextResponse.redirect(new URL("/login", request.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};