proxy.ts

// proxy.ts
import { NextResponse, type NextRequest } from 'next/server';
import { createServerClient } from '@supabase/ssr';
import { isAdminTokenValid } from '@/lib/admin-auth';

// Public routes yang tidak perlu auth Supabase
const publicRoutes = ['/', '/login', '/share'];

export default async function proxy(request: NextRequest) {
  const { pathname } = request.nextUrl;

  // Skip static files & internal routes
  if (
    pathname.startsWith('/_next') ||
    pathname.startsWith('/api') ||
    pathname.startsWith('/auth') ||
    pathname.match(/\.(jpg|jpeg|png|gif|ico|svg|webp)$/)
  ) {
    return NextResponse.next();
  }

  // ── Admin routes ─────────────────────────────────────────────────────────────
  if (pathname.startsWith('/admin')) {
    if (pathname === '/admin/login') {
      const token = request.cookies.get('admin_token')?.value;
      if (await isAdminTokenValid(token)) {
        return NextResponse.redirect(new URL('/admin', request.url));
      }
      return NextResponse.next();
    }

    const token = request.cookies.get('admin_token')?.value;
    if (!await isAdminTokenValid(token)) {
      return NextResponse.redirect(new URL('/admin/login', request.url));
    }

    return NextResponse.next();
  }

  // ── Public routes — skip Supabase check ──────────────────────────────────────
  if (publicRoutes.some(r => pathname === r || pathname.startsWith(r + '/'))) {
    return NextResponse.next();
  }

  // ── Protected routes — cek Supabase session ──────────────────────────────────
  let response = NextResponse.next({ request: { headers: request.headers } });

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        getAll() { return request.cookies.getAll(); },
        setAll(cookiesToSet) {
          cookiesToSet.forEach(({ name, value, options }) => {
            request.cookies.set({ name, value, ...options });
            response.cookies.set({ name, value, ...options });
          });
        },
      },
    }
  );

  // Ambil session DAN error dari Supabase
  const { data: { session }, error } = await supabase.auth.getSession();
  const guestCookie = request.cookies.get('wc_guest_mode');
  const isGuest = guestCookie?.value === 'true';

  // FIX: Jika ada error auth (seperti Invalid Refresh Token), langsung bersihkan cookie-nya
  if (error) {
    console.error('Middleware Auth Error, otomatis membersihkan sesi:', error.message);
    
    const url = request.nextUrl.clone();
    url.pathname = '/login';
    // Kita hilangkan parameter ?redirect agar tidak loop, karena sesinya memang bermasalah
    const errorResponse = NextResponse.redirect(url);

    // Hapus semua cookie bawaan Supabase yang nyangkut (biasanya berawalan 'sb-')
    request.cookies.getAll().forEach((cookie) => {
      if (cookie.name.startsWith('sb-')) {
        errorResponse.cookies.delete(cookie.name);
      }
    });

    return errorResponse;
  }

  if (!session && !isGuest) {
    const url = request.nextUrl.clone();
    url.pathname = '/login';
    url.searchParams.set('redirect', pathname);
    return NextResponse.redirect(url);
  }

  return response;
}

export const config = {
  // Fix: exclude /api/* dari matcher supaya API routes tidak disentuh middleware
  matcher: ['/((?!_next/static|_next/image|favicon\\.ico|api/).*)',],
};