middleware.ts

// middleware.ts
import { NextRequest, NextResponse } from 'next/server';

const PUBLIC_ASSET =
  /\.(?:avif|css|eot|gif|ico|jpe?g|js|map|mp3|mp4|ogg|png|svg|ttf|webmanifest|webm|webp|woff2?)$/i;

const publicRoutes = new Set([
  '/',
  '/login',
  '/about',
  '/privacy',
  '/terms',
  '/robots.txt',
  '/sitemap.xml',
  '/llms.txt',
]);

export function middleware(request: NextRequest) {
  const { pathname, search } = request.nextUrl;

  if (
    pathname.startsWith('/_next/') ||
    pathname.startsWith('/static/') ||
    PUBLIC_ASSET.test(pathname)
  ) {
    return NextResponse.next();
  }

  if (publicRoutes.has(pathname)) {
    return NextResponse.next();
  }

  // Cookie presence only — protected APIs verify Privy tokens server-side.
  const token = request.cookies.get('privy-token');

  if (!token) {
    const loginUrl = new URL('/login', request.url);
    const redirectAfter =
      pathname.startsWith('/') && !pathname.startsWith('//')
        ? `${pathname}${search}`
        : '/dashboard';
    loginUrl.searchParams.set('redirect_after', redirectAfter);
    return NextResponse.redirect(loginUrl);
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/((?!api|_next/static|_next/image|favicon.ico).*)'],
};