middleware.ts

import { NextResponse, type NextRequest } from "next/server";
import { createMiddlewareClient } from "@supabase/auth-helpers-nextjs";

// Simple in-memory rate limiting (for production, use Redis or similar)
const rateLimitMap = new Map<string, { count: number; resetTime: number }>();

function rateLimit(ip: string, limit: number = 5, windowMs: number = 15 * 60 * 1000): boolean {
	const now = Date.now();
	const key = ip;
	const current = rateLimitMap.get(key);

	if (!current || now > current.resetTime) {
		rateLimitMap.set(key, { count: 1, resetTime: now + windowMs });
		return true;
	}

	if (current.count >= limit) {
		return false;
	}

	current.count++;
	return true;
}

export async function middleware(request: NextRequest) {
	const response = NextResponse.next();
	
	// Rate limiting for auth routes
	const authRoutes = ["/signin", "/signup"];
	const isAuthRoute = authRoutes.some(route => request.nextUrl.pathname.startsWith(route));
	
	if (isAuthRoute) {
		const ip = request.ip || request.headers.get("x-forwarded-for") || "unknown";
		if (!rateLimit(ip)) {
			return new NextResponse("Too Many Requests", { status: 429 });
		}
	}

	const supabase = createMiddlewareClient({ req: request, res: response });

	// Refresh session if expired - required for Server Components
	const { data: { session } } = await supabase.auth.getSession();

	// Protected routes that require authentication
	const protectedRoutes = ["/dashboard", "/games", "/profile", "/progress", "/leaderboard", "/social", "/settings"];
	const isProtectedRoute = protectedRoutes.some(route => request.nextUrl.pathname.startsWith(route));

	// Auth routes that should redirect if already authenticated
	const authRoutes = ["/signin", "/signup"];
	const isAuthRoute = authRoutes.some(route => request.nextUrl.pathname.startsWith(route));

	if (isProtectedRoute && !session) {
		// Redirect to signin if trying to access protected route without session
		const redirectUrl = new URL("/signin", request.url);
		redirectUrl.searchParams.set("redirectTo", request.nextUrl.pathname);
		return NextResponse.redirect(redirectUrl);
	}

	if (isAuthRoute && session) {
		// Redirect to dashboard if trying to access auth routes while authenticated
		return NextResponse.redirect(new URL("/dashboard", request.url));
	}

	// Add cache control headers
	response.headers.set("Cache-Control", "no-store");
	
	return response;
}

export const config = {
	matcher: [
		"/dashboard/:path*", 
		"/games/:path*", 
		"/profile/:path*", 
		"/progress/:path*", 
		"/leaderboard/:path*", 
		"/social/:path*", 
		"/settings/:path*",
		"/signin/:path*", 
		"/signup/:path*"
	],
};