admins
fa7c25465c
Second-brain scheme (logo + six cards with rays) reworked from the old platform's infographic. Root stays role-redirecting for signed-in users; middleware opens "/" as an exact match only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
38 lines
1.4 KiB
TypeScript
38 lines
1.4 KiB
TypeScript
import { NextRequest, NextResponse } from "next/server";
|
|
import { getSessionCookie } from "better-auth/cookies";
|
|
|
|
const PUBLIC_ROUTES = ["/login", "/register", "/verify-email", "/forgot-password", "/reset-password", "/api/auth", "/api/register", "/api/internal", "/maintenance", "/share/wrapped"];
|
|
|
|
export function middleware(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
// Прямой Better Auth sign-up обходит Turnstile/honeypot-обёртку
|
|
// (/api/register) — наружу закрыт. Сама регистрация не страдает:
|
|
// /api/register вызывает auth.handler программно, минуя middleware.
|
|
if (pathname.startsWith("/api/auth/sign-up")) {
|
|
return new NextResponse(null, { status: 404 });
|
|
}
|
|
|
|
if (
|
|
pathname === "/" || // public welcome page; "/" must stay an EXACT match (startsWith would open everything)
|
|
PUBLIC_ROUTES.some((route) => pathname.startsWith(route)) ||
|
|
pathname.startsWith("/_next") ||
|
|
pathname.startsWith("/favicon") ||
|
|
pathname === "/logo.svg"
|
|
) {
|
|
return NextResponse.next();
|
|
}
|
|
|
|
const sessionCookie = getSessionCookie(request);
|
|
|
|
if (!sessionCookie) {
|
|
return NextResponse.redirect(new URL("/login", request.url));
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
|
|
};
|