middleware.ts

import { createServerClient } from '@supabase/ssr'
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export async function middleware(req: NextRequest) {
  // Skip middleware for static files and API routes that don't need auth
  const { pathname } = req.nextUrl
  
  // Skip middleware for static assets and API routes
  if (
    pathname.startsWith('/_next') ||
    pathname.startsWith('/api/') ||
    pathname.includes('.') ||
    pathname === '/favicon.ico'
  ) {
    return NextResponse.next()
  }

  // Check for required environment variables
  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL
  const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY || process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY

  if (!supabaseUrl || !supabaseKey) {
    console.error('Missing Supabase environment variables')
    // Allow access without auth check if env vars are missing (for initial deployment)
    return NextResponse.next()
  }

  let supabaseResponse = NextResponse.next({
    request: {
      headers: req.headers,
    },
  })

  try {
    const supabase = createServerClient(
      supabaseUrl,
      supabaseKey,
      {
        cookies: {
          getAll() {
            return req.cookies.getAll()
          },
          setAll(cookiesToSet) {
            cookiesToSet.forEach(({ name, value }) => 
              req.cookies.set(name, value)
            )
            supabaseResponse = NextResponse.next({
              request: req,
            })
            cookiesToSet.forEach(({ name, value, options }) =>
              supabaseResponse.cookies.set(name, value, options)
            )
          },
        },
      }
    )

    const {
      data: { session },
    } = await supabase.auth.getSession()

  // Auth required routes
  const authRequiredPaths = [
    '/dashboard',
    '/profile',
    '/goals',
    '/collaborations',
  ]

  // Organization admin required routes  
  const orgAdminRequiredPaths = [
    '/organization',
  ]

  // Admin required routes
  const adminRequiredPaths = [
    '/admin',
  ]

  const { pathname } = req.nextUrl

  // Check if route requires authentication
  const requiresAuth = authRequiredPaths.some(path => 
    pathname.startsWith(path)
  )

  // Check if route requires organization admin access
  const requiresOrgAdmin = orgAdminRequiredPaths.some(path => 
    pathname.startsWith(path)
  )

  // Check if route requires admin access
  const requiresAdmin = adminRequiredPaths.some(path => 
    pathname.startsWith(path)
  )

  // Temporary bypass for admin routes when session creation fails
  // TODO: Remove this once admin session creation is working properly
  if (requiresAdmin && !session) {
    console.log('Admin route accessed without session - allowing access temporarily')
    // For now, allow access to admin routes without session verification
    // This is a temporary workaround
    return NextResponse.next()
  }

  // Redirect to login if auth required but no session
  if ((requiresAuth || requiresOrgAdmin || requiresAdmin) && !session) {
    const redirectUrl = req.nextUrl.clone()
    if (requiresOrgAdmin) {
      redirectUrl.pathname = '/auth/organization/login'
    } else if (requiresAdmin) {
      redirectUrl.pathname = '/auth/admin/login'  // We'll create this
    } else {
      redirectUrl.pathname = '/auth/login'
    }
    redirectUrl.searchParams.set('redirectTo', pathname)
    return NextResponse.redirect(redirectUrl)
  }

  // Check organization admin access
  if (requiresOrgAdmin && session) {
    const { data: profile } = await supabase
      .from('profiles')
      .select('user_type, organization_users(role)')
      .eq('id', session.user.id)
      .single()

    const isOrgAdmin = profile?.organization_users?.some((ou: { role: string }) => ou.role === 'admin')

    if (!isOrgAdmin) {
      const redirectUrl = req.nextUrl.clone()
      redirectUrl.pathname = '/dashboard'
      return NextResponse.redirect(redirectUrl)
    }
  }

  // Check admin access
  if (requiresAdmin && session) {
    const { data: profile } = await supabase
      .from('profiles')
      .select('role')
      .eq('id', session.user.id)
      .single()

    if (!profile || profile.role !== 'admin') {
      const redirectUrl = req.nextUrl.clone()
      redirectUrl.pathname = '/dashboard'
      return NextResponse.redirect(redirectUrl)
    }
  }


  // Redirect authenticated users away from auth pages
  if (session && pathname.startsWith('/auth/')) {
    const redirectUrl = req.nextUrl.clone()
    redirectUrl.pathname = '/dashboard'
    return NextResponse.redirect(redirectUrl)
  }

    return supabaseResponse
  } catch (error) {
    console.error('Middleware error:', error)
    // Return next() to allow access if middleware fails
    return NextResponse.next()
  }
}

export const config = {
  matcher: [
    /*
     * Match all request paths except for the ones starting with:
     * - api (API routes)
     * - _next/static (static files)
     * - _next/image (image optimization files)
     * - favicon.ico (favicon file)
     * - public folder
     */
    '/((?!api|_next/static|_next/image|favicon.ico|public/).*)',
  ],
}