import { NextResponse, type NextRequest } from "next/server"
import { getSessionCookie } from "better-auth/cookies"

const PROTECTED_PATHS = [
  "/admin",
  "/dashboard",
  "/properties",
  "/tenants",
  "/rent",
  "/maintenance",
  "/leases",
  "/expenses",
  "/settings",
  "/onboarding",
  "/calendar",
  "/inspections",
  "/vendors",
  "/reports",
  "/activity",
  "/ai",
  "/ai-dashboard",
  "/predictions",
  "/recommendations",
  "/impact",
  "/follow-ups",
]

const AUTH_PATHS = ["/login", "/signup", "/forgot-password"]

export async function proxy(request: NextRequest) {
  const pathname = request.nextUrl.pathname

  // Optimistic check based on the presence of the session cookie. Real
  // enforcement happens in routes / server components via getSessionUser().
  const sessionCookie = getSessionCookie(request)

  const isProtected = PROTECTED_PATHS.some((p) => pathname.startsWith(p))
  if (isProtected && !sessionCookie) {
    const url = request.nextUrl.clone()
    url.pathname = "/login"
    return NextResponse.redirect(url)
  }

  const isAuthPage = AUTH_PATHS.some((p) => pathname.startsWith(p))
  if (isAuthPage && sessionCookie) {
    const url = request.nextUrl.clone()
    url.pathname = "/dashboard"
    return NextResponse.redirect(url)
  }

  return NextResponse.next()
}

export const config = {
  matcher: [
    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)",
  ],
}