// ❌ Without middleware — repeated authentication code on every page

// 📁 app/dashboard/page.tsx
import { cookies } from 'next/headers';
import { redirect } from 'next/navigation';

export default async function Dashboard() {
  const session = cookies().get('session')?.value;
  if (!session) redirect('/login?next=/dashboard');
  // ... page body
}

// 📁 app/bookmark/page.tsx
export default async function Bookmark() {
  const session = cookies().get('session')?.value;
  if (!session) redirect('/login?next=/bookmark');
  // ... same code
}

// 📁 app/memo-notes/page.tsx
export default async function MemoNotes() {
  const session = cookies().get('session')?.value;
  if (!session) redirect('/login?next=/memo-notes');
  // ... same code again
}

// Disadvantages:
// - 4 lines duplicated on every page
// - Easy to forget when adding new pages
// - If authentication policy changes, all pages need modification
// - Validation occurs only after page component executes → slight compile/transfer overhead

// ✅ Integrated with middleware — page components have no authentication code

// 📁 src/middleware.ts
import { NextResponse, type NextRequest } from 'next/server';

const PROTECTED_ROUTES = ['/dashboard', '/bookmark', '/memo-notes'];
const ADMIN_ROUTES = ['/admin'];

export function middleware(req: NextRequest) {
  const session = req.cookies.get('session')?.value;
  const path = req.nextUrl.pathname;

  // 1. Protected routes → if not logged in, redirect to login page
  if (PROTECTED_ROUTES.some(p => path.startsWith(p))) {
    if (!session) {
      const loginUrl = new URL('/login', req.url);
      loginUrl.searchParams.set('next', path);
      return NextResponse.redirect(loginUrl);
    }
  }

  // 2. Admin routes → separate permission check
  if (ADMIN_ROUTES.some(p => path.startsWith(p))) {
    const adminToken = req.cookies.get('admin')?.value;
    if (!adminToken) {
      return NextResponse.redirect(new URL('/admin/login', req.url));
    }
  }

  // 3. Response headers — enhance security
  const res = NextResponse.next();
  res.headers.set('X-Frame-Options', 'DENY');
  res.headers.set('X-Content-Type-Options', 'nosniff');
  return res;
}

export const config = {
  matcher: [
    // All paths except _next/static·_next/image·favicon·api
    '/((?!_next/static|_next/image|favicon.ico|api).*)',
  ],
};

// 📁 app/dashboard/page.tsx — now clean
export default async function Dashboard() {
  // No session validation code — middleware already blocked it
  // If reached, confirmed authenticated user
  const data = await db.dashboard.find();
  return <div>{/* ... */}</div>;
}

// Advantages:
// - Protected policy concentrated in one place
// - New protected page = just add to PROTECTED_ROUTES array
// - Edge Runtime → fast response (blocked before reaching page component)
// - Page component is clean (no authentication logic, only business logic)