proxy.js

import { createServerClient } from "@supabase/ssr";
import { NextResponse } from "next/server";

// Mirrors the role→portal mapping in app/auth/login/page.js.
const STUDIO_ROLES = ["designer", "admin", "founder"];
const DIRECTOR_ROLES = ["director"];

export async function proxy(request) {
  // Skip auth in dev when Supabase env vars aren't configured yet
  if (!process.env.NEXT_PUBLIC_SUPABASE_URL || !process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY) {
    return NextResponse.next({ request });
  }

  let supabaseResponse = NextResponse.next({ request });

  const supabase = createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY,
    {
      cookies: {
        getAll() { return request.cookies.getAll(); },
        setAll(cookiesToSet) {
          cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value));
          supabaseResponse = NextResponse.next({ request });
          cookiesToSet.forEach(({ name, value, options }) =>
            supabaseResponse.cookies.set(name, value, options)
          );
        },
      },
    }
  );

  const { data: { user } } = await supabase.auth.getUser();
  const { pathname } = request.nextUrl;
  const requiredRoles = pathname.startsWith("/studio/analytics")
    ? ["admin", "founder"]
    : pathname.startsWith("/studio")
      ? STUDIO_ROLES
      : pathname.startsWith("/director")
      ? DIRECTOR_ROLES
      : null;

  if (requiredRoles) {
    if (!user) {
      const url = request.nextUrl.clone();
      url.pathname = "/auth/login";
      url.searchParams.set("from", pathname);
      return NextResponse.redirect(url);
    }

    // Being logged in isn't enough — confirm the caller actually holds a
    // staff role before letting them into /studio or /director.
    const { data: profile } = await supabase.from("profiles").select("role").eq("id", user.id).single();
    if (!profile || !requiredRoles.includes(profile.role)) {
      const url = request.nextUrl.clone();
      url.pathname = "/";
      url.search = "";
      return NextResponse.redirect(url);
    }
  }

  return supabaseResponse;
}

export const config = {
  matcher: ["/studio/:path*", "/director/:path*", "/auth/callback"],
};