proxy.ts

import NextAuth from "next-auth";
import { authConfig } from "@/auth.config";
import { NextResponse } from "next/server";

/**
 * Edge-runtime auth gate for protected routes. Uses the slim authConfig only
 * — Firestore and other Node-only deps are loaded inside server components / API routes.
 */
const { auth } = NextAuth(authConfig);

const PROTECTED_PREFIXES = ["/dashboard", "/inbox", "/research"];

export default auth((req) => {
  const { pathname, search } = req.nextUrl;

  if (req.nextUrl.searchParams.get("demo") === "1") {
    return NextResponse.next();
  }

  const requiresAuth = PROTECTED_PREFIXES.some((p) => pathname.startsWith(p));
  if (!requiresAuth) return NextResponse.next();

  if (!req.auth) {
    const signInUrl = new URL("/api/auth/signin", req.nextUrl.origin);
    signInUrl.searchParams.set("callbackUrl", pathname + search);
    return NextResponse.redirect(signInUrl);
  }

  return NextResponse.next();
});

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico|api/auth|api/cron).*)"],
};