Middleware

// middleware.ts — at the project root, beside app/
import { NextRequest, NextResponse } from 'next/server'

export function middleware(req: NextRequest) {
  const session = req.cookies.get('sid')

  if (!session && req.nextUrl.pathname.startsWith('/dashboard')) {
    const url = new URL('/login', req.url)
    url.searchParams.set('from', req.nextUrl.pathname)     // come back after
    return NextResponse.redirect(url)
  }

  const res = NextResponse.next()
  res.headers.set('x-request-id', crypto.randomUUID())
  return res
}

// The matcher is the performance control. Without it, middleware runs
// for every request including static assets.
export const config = {
  matcher: [
    '/dashboard/:path*',
    '/admin/:path*',
    // or everything except assets and images:
    '/((?!api|_next/static|_next/image|favicon.ico).*)',
  ],
}

// It also runs on prefetches, so a redirect here fires more often
// than you expect — keep it cheap.

// Runs on the edge runtime, so these are unavailable:
//   fs, net, most Node built-ins
//   a Prisma or pg client (a TCP connection)
//   bcrypt and other native modules
//   heavy libraries — the bundle has a size cap

// Which means you CANNOT look up a session in the database here. The
// usual shape is a stateless check only:
const token = req.cookies.get('token')?.value
if (!token) return NextResponse.redirect(new URL('/login', req.url))
// Verify a JWT signature with jose (edge-compatible) if you need more,
// and accept that revocation is not visible here.

// Keep it under a few milliseconds. Every request in the matcher pays
// this cost, on every page view, forever.

// Other things it can do:
NextResponse.rewrite(new URL('/maintenance', req.url))    // URL unchanged
res.cookies.set('locale', 'en-IN')
req.headers.get('x-forwarded-for')                        // geo, A/B, bot checks

// Things it should not do: call your API, log to a slow sink, run
// business logic, or make a decision that needs fresh data.

// Middleware is a redirect for convenience — it stops a signed-out
// user landing on a dashboard shell. It is NOT the check that keeps
// data safe.

// CVE-2025-29927 allowed middleware to be skipped entirely with a
// crafted x-middleware-subrequest header. Applications that relied on
// it as their only gate were exposed. Patch releases fixed the bypass;
// the architectural lesson stands.

// So authorise where the data is read or written:
//   server component  -> check before querying
//   server action     -> check before mutating
//   route handler     -> check before responding
const user = await requireUser()          // throws or redirects
const rows = await db.thing.findMany({ where: { userId: user.id } })

// The Data Access Layer pattern makes this hard to forget: every read
// goes through a function that takes the session, so a query written
// without one does not compile.

// Use middleware for:
//   redirecting unauthenticated users away from an app shell
//   locale and geo routing
//   A/B assignment, maintenance mode, request ids
// Never for:
//   deciding who may see which record