middleware.ts

import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"

const SESSION_COOKIE_NAME = "yeetcode_session"

// Routes that require authentication
const PROTECTED_ROUTES = ["/dashboard", "/group"]

// Routes that should redirect to dashboard if already authenticated
const AUTH_ROUTES = ["/login", "/verify", "/onboarding"]

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl
  const sessionCookie = request.cookies.get(SESSION_COOKIE_NAME)

  // Check if user is authenticated
  let isAuthenticated = false
  let sessionData: {
    email?: string
    verified?: boolean
    user?: { username?: string; group_id?: string }
    isNewUser?: boolean
  } | null = null

  if (sessionCookie?.value) {
    try {
      sessionData = JSON.parse(
        Buffer.from(sessionCookie.value, "base64").toString("utf-8")
      )
      isAuthenticated = !!sessionData?.verified
    } catch {
      // Invalid session cookie
      isAuthenticated = false
    }
  }

  // Check if trying to access protected routes without auth
  if (PROTECTED_ROUTES.some((route) => pathname.startsWith(route))) {
    if (!isAuthenticated) {
      // Redirect to login
      return NextResponse.redirect(new URL("/login", request.url))
    }

    // If authenticated but new user (no username), redirect to onboarding
    if (sessionData?.isNewUser && pathname !== "/onboarding") {
      return NextResponse.redirect(new URL("/onboarding", request.url))
    }

    // If authenticated but no group, redirect to group page
    if (
      sessionData?.user &&
      !sessionData.user.group_id &&
      !pathname.startsWith("/group")
    ) {
      return NextResponse.redirect(new URL("/group", request.url))
    }
  }

  // Check if trying to access auth routes when already authenticated
  if (AUTH_ROUTES.some((route) => pathname.startsWith(route))) {
    if (isAuthenticated && !sessionData?.isNewUser) {
      // If user has a group, go to dashboard
      if (sessionData?.user?.group_id) {
        return NextResponse.redirect(new URL("/dashboard", request.url))
      }
      // Otherwise go to group selection
      return NextResponse.redirect(new URL("/group", request.url))
    }
  }

  // Handle root path based on auth status
  if (pathname === "/") {
    if (isAuthenticated && !sessionData?.isNewUser) {
      if (sessionData?.user?.group_id) {
        return NextResponse.redirect(new URL("/dashboard", request.url))
      }
      return NextResponse.redirect(new URL("/group", request.url))
    }
    // If not authenticated, show landing page (no redirect needed)
  }

  return NextResponse.next()
}

export const config = {
  matcher: [
    /*
     * Match all request paths except:
     * - api routes
     * - _next (Next.js internals)
     * - static files (images, fonts, etc.)
     */
    "/((?!api|_next/static|_next/image|favicon.ico|.*\\..*|yeetcode_icon.png).*)",
  ],
}