import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { jwtVerify } from 'jose';

const SESSION_COOKIE_NAME = 'arbeitszeit_session';
const secretKey = process.env.AUTH_SECRET;
if (!secretKey) throw new Error('AUTH_SECRET Umgebungsvariable ist nicht gesetzt!');
const key = new TextEncoder().encode(secretKey);

export async function proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;

  if (
    pathname.startsWith('/login') ||
    pathname.startsWith('/_next') ||
    pathname.startsWith('/favicon') ||
    // Passkey-Anmeldung muss ohne Session erreichbar sein.
    pathname.startsWith('/api/passkey/authenticate')
  ) {
    return NextResponse.next();
  }

  const cookie = request.cookies.get(SESSION_COOKIE_NAME);

  if (!cookie?.value) {
    return NextResponse.redirect(new URL('/login', request.url));
  }

  try {
    await jwtVerify(cookie.value, key, { algorithms: ['HS256'] });
    return NextResponse.next({
      headers: {
        'X-Frame-Options': 'DENY',
      },
    });
  } catch {
    return NextResponse.redirect(new URL('/login', request.url));
  }
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};