1import { NextResponse } from "next/server"
2import type { NextRequest } from "next/server"
3 
4const protectedRoutes = ["/dashboard", "/settings", "/api/private"]
5const publicRoutes = ["/login", "/signup", "/forgot-password"]
6 
7export function middleware(request: NextRequest) {
8  const { pathname } = request.nextUrl
9  const sessionToken = request.cookies.get("session")?.value
10 
11  const isProtected = protectedRoutes.some(r => pathname.startsWith(r))
12  const isPublic = publicRoutes.some(r => pathname.startsWith(r))
13 
14  if (isProtected && !sessionToken) {
15    const loginUrl = new URL("/login", request.url)
16    loginUrl.searchParams.set("redirect", pathname)
17    return NextResponse.redirect(loginUrl)
18  }
19 
20  if (isPublic && sessionToken) {
21    return NextResponse.redirect(new URL("/dashboard", request.url))
22  }
23 
24  const response = NextResponse.next()
25  response.headers.set("X-Frame-Options", "DENY")
26  response.headers.set("X-Content-Type-Options", "nosniff")
27  return response
28}
29 
30export const config = {
31  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
32}