import { withAuth } from "next-auth/middleware";
import { NextResponse } from "next/server";
import type { UserRole } from "@/types";

function forceLogout(req: { url: string }, reason: string) {
  const login = `/login?error=${encodeURIComponent(reason)}`;
  const dest = `/api/auth/force-logout?callbackUrl=${encodeURIComponent(login)}`;
  return NextResponse.redirect(new URL(dest, req.url));
}

export default withAuth(
  function middleware(req) {
    const token = req.nextauth.token;
    const pathname = req.nextUrl.pathname;
    const role = token?.role as UserRole | undefined;

    if (token?.error || !token?.id) {
      return forceLogout(req, "SessionExpired");
    }

    if (pathname.startsWith("/admin")) {
      if (role !== "super_admin") {
        return forceLogout(req, "Forbidden");
      }
    }

    if (pathname.startsWith("/app")) {
      if (role !== "client" && role !== "super_admin") {
        return forceLogout(req, "Forbidden");
      }
      if (role === "client" && !token?.workspaceId) {
        return NextResponse.redirect(new URL("/onboarding", req.url));
      }
      if (role === "super_admin" && !token?.workspaceId) {
        return NextResponse.redirect(new URL("/admin/overview", req.url));
      }
    }

    if (pathname.startsWith("/onboarding")) {
      if (role !== "client") {
        if (role === "super_admin") {
          return NextResponse.redirect(new URL("/admin/overview", req.url));
        }
        return forceLogout(req, "Forbidden");
      }
    }

    return NextResponse.next();
  },
  {
    callbacks: {
      authorized: ({ token, req }) => {
        const pathname = req.nextUrl.pathname;

        if (
          pathname.startsWith("/admin") ||
          pathname.startsWith("/app") ||
          pathname.startsWith("/onboarding")
        ) {
          return Boolean(token?.id) && !token?.error;
        }

        return true;
      },
    },
  }
);

export const config = {
  matcher: ["/admin/:path*", "/app/:path*", "/onboarding/:path*"],
};