middleware.ts · Source

middleware.tsapps/web/src/middleware.tsraw ← src2,192 B← Back to the app
1import { NextRequest, NextResponse } from "next/server";
2 
3/**
4 * Auth gate (PRODUCT-SPEC §24 / ARCHITECTURE.md §3):
5 * - Session = httpOnly `factory_refresh` cookie (refresh token, set by the
6 *   API on /auth/login and /auth/register, rotated on /auth/refresh). The
7 *   middleware can only check *existence*; the API re-validates every
8 *   request. (The cookie is HttpOnly — the client never sees its value;
9 *   the access token lives in JS memory only, see security-architecture.md.)
10 * - No cookie + protected path → /login?next=<path>.
11 * - Cookie + auth page → first workspace (or /w/default).
12 */
13const SESSION_COOKIE = "factory_refresh";
14 
15const PUBLIC_PREFIXES = ["/login", "/register", "/reset-password", "/share/", "/f/", "/health"];
16 
17/** Static assets & next internals that never hit the session gate. */
18const PUBLIC_PATH_PREFIXES = ["/_next", "/favicon.ico", "/robots.txt", "/sitemap.xml"];
19 
20function isPublicPath(pathname: string): boolean {
21  if (PUBLIC_PATH_PREFIXES.some((p) => pathname.startsWith(p))) return true;
22  return PUBLIC_PREFIXES.some((p) => (p.endsWith("/") ? pathname.startsWith(p) : pathname === p));
23}
24 
25export function middleware(request: NextRequest): NextResponse {
26  const { pathname } = request.nextUrl;
27  const hasSession = request.cookies.has(SESSION_COOKIE);
28 
29  // Authenticated users don't need login/register/reset pages.
30  if (hasSession && (pathname === "/login" || pathname === "/register" || pathname === "/reset-password")) {
31    const redirect = request.nextUrl.clone();
32    redirect.pathname = "/w/default";
33    redirect.search = "";
34    return NextResponse.redirect(redirect);
35  }
36 
37  // Unauthenticated visitors are only allowed on public paths.
38  if (!hasSession && !isPublicPath(pathname)) {
39    const login = request.nextUrl.clone();
40    login.pathname = "/login";
41    login.search = "";
42    login.searchParams.set("next", pathname + request.nextUrl.search);
43    return NextResponse.redirect(login);
44  }
45 
46  return NextResponse.next();
47}
48 
49export const config = {
50  matcher: [
51    // Match everything except static files (handled above for clarity).
52    "/((?!_next/static|_next/image|favicon.ico|robots.txt|sitemap.xml).*)"
53  ]
54};
55