twotalesanimation
69 lines
2.1 KiB
TypeScript
69 lines
2.1 KiB
TypeScript
import NextAuth from "next-auth";
|
|
import { authConfig } from "@/auth.config";
|
|
import { NextResponse } from "next/server";
|
|
|
|
const { auth } = NextAuth(authConfig);
|
|
|
|
export default auth((req) => {
|
|
const pathname = req.nextUrl.pathname;
|
|
|
|
// Allow all static files (svg, png, jpg, pdf, mp4, woff2, etc.)
|
|
if (pathname.includes(".")) return;
|
|
|
|
const isLoggedIn = !!req.auth;
|
|
|
|
// Always allow auth API routes
|
|
if (pathname.startsWith("/api/auth")) return;
|
|
|
|
// Allow client review portal with token (no auth needed)
|
|
if (pathname.startsWith("/client/")) return;
|
|
|
|
// Allow token-gated client API routes (comments, approvals via review token)
|
|
if (pathname.startsWith("/api/client/")) return;
|
|
|
|
// Allow external/scripting API routes (authenticated via API key header)
|
|
if (pathname.startsWith("/api/ext/")) return;
|
|
|
|
// Allow display device routes (ESP32 dot-matrix, authenticated via API key header)
|
|
if (pathname.startsWith("/api/display/")) return;
|
|
|
|
// Allow dashboard stats via display key (ESP32 polls this)
|
|
if (pathname === "/api/dashboard/stats") return;
|
|
|
|
// Allow local file serving (needed for video playback in client portal)
|
|
if (pathname.startsWith("/api/files/")) return;
|
|
|
|
// Allow upload webhook endpoints
|
|
if (pathname.startsWith("/api/uploadthing")) return;
|
|
|
|
// Redirect logged-in users away from login page
|
|
if (pathname === "/login" && isLoggedIn) {
|
|
return NextResponse.redirect(new URL("/dashboard", req.url));
|
|
}
|
|
|
|
// Force password change
|
|
if (
|
|
isLoggedIn &&
|
|
req.auth?.user?.mustChangePassword &&
|
|
pathname !== "/settings" &&
|
|
!pathname.startsWith("/api/") &&
|
|
!pathname.startsWith("/_next/")
|
|
) {
|
|
return NextResponse.redirect(new URL("/settings", req.url));
|
|
}
|
|
|
|
// Redirect unauthenticated users to login
|
|
if (!isLoggedIn && pathname !== "/login") {
|
|
const loginUrl = new URL("/login", req.url);
|
|
loginUrl.searchParams.set("callbackUrl", pathname);
|
|
return NextResponse.redirect(loginUrl);
|
|
}
|
|
});
|
|
|
|
export const config = {
|
|
matcher: [
|
|
// Skip Next.js internals and any file with an extension
|
|
"/((?!_next/static|_next/image|favicon.ico|.*\\..*).*)",
|
|
],
|
|
};
|