import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

// Rutas públicas que no requieren autenticación
const PUBLIC_ROUTES = ["/login"];

// Rutas que siempre deben ser accesibles (assets, API, etc.)
const ALWAYS_ALLOWED = ["/_next", "/api", "/favicon.ico", "/avatar.jpg"];

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;

  // Permitir siempre assets y APIs
  if (ALWAYS_ALLOWED.some((route) => pathname.startsWith(route))) {
    return NextResponse.next();
  }

  // Obtener token de las cookies (si existe)
  const token = request.cookies.get("dolibarr_auth_token")?.value;

  // Verificar si es ruta pública
  const isPublicRoute = PUBLIC_ROUTES.some((route) => pathname === route);

  if (!token && !isPublicRoute) {
    // No hay token y la ruta es privada -> redirigir a login
    const loginUrl = new URL("/login", request.url);
    loginUrl.searchParams.set("redirect", pathname);
    return NextResponse.redirect(loginUrl);
  }

  if (token && pathname === "/login") {
    // Hay token y está en login -> redirigir a home
    return NextResponse.redirect(new URL("/", request.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: [
    /*
     * Match all request paths except:
     * - _next/static (static files)
     * - _next/image (image optimization files)
     * - favicon.ico (favicon file)
     * - public folder
     */
    "/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)",
  ],
};