middleware.ts

import { NextResponse } from "next/server";
import { authMiddleware, redirectToSignIn } from "@clerk/nextjs";
 
// This example protects all routes including api/trpc routes
// Please edit this to allow other routes to be public as needed.
// See https://clerk.com/docs/references/nextjs/auth-middleware for more information about configuring your Middleware
export default authMiddleware({
  publicRoutes: ["/", "/api/webhook"],
  afterAuth(auth, req) {
    // Restrict public routes when logged in
    if (auth.userId && auth.isPublicRoute) {
      let path = "select-org"

      if (auth.orgId) {
        path = `organization/${auth.orgId}`
      }

      const orgSelection = new URL(path, req.url)
      return NextResponse.redirect(orgSelection)
    }

    // When trying to access private route when not logged in
    if (!auth.userId && !auth.isPublicRoute) {
      return redirectToSignIn({ returnBackUrl: req.url })
    }

    // When logged in, but not in organization and not on select-org route
    if (auth.userId && !auth.orgId && req.nextUrl.pathname !== "/select-org") {
      const orgSelection = new URL("/select-org", req.url)
      return NextResponse.redirect(orgSelection)
    }
  }
});
 
export const config = {
  matcher: ['/((?!.+\\.[\\w]+$|_next).*)', '/', '/(api|trpc)(.*)'],
};