import { NextResponse, type NextRequest } from "next/server";

const PUBLIC = new Set(["/login", "/setup-2fa"]);

export function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl;
  if (pathname.startsWith("/api/auth") || PUBLIC.has(pathname) || pathname === "/_next" || pathname.startsWith("/_next")) {
    return NextResponse.next();
  }
  const hasSession =
    req.cookies.get("__Secure-sp.session_token") ||
    req.cookies.get("sp.session_token");
  if (!hasSession && pathname === "/") {
    const url = req.nextUrl.clone();
    url.pathname = "/login";
    return NextResponse.redirect(url);
  }
  return NextResponse.next();
}

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico|api/health).*)"],
};