Function middleware

src/middleware.ts:149–194

(req: NextRequest)

// Middleware
// ---------------------------------------------------------------------------
export function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl;
  const method = req.method;

  // --- Admin auth check ---
  if (requiresAuth(pathname, method)) {
    if (!isAuthorized(req)) {
      const res = NextResponse.json({ error: "Unauthorized" }, { status: 401 });
      applySecurityHeaders(res);
      return res;
    }
  }

  // --- Rate limiting (API routes only, exempt health check) ---
  if (pathname.startsWith("/api/") && pathname !== "/api/health") {
    const ip = getClientIP(req);
    const tier = getTier(pathname);
    const rl = checkRateLimit(ip, tier);

    if (!rl.allowed) {
      const res = NextResponse.json(
        { error: "Too many requests" },
        { status: 429 }
      );
      res.headers.set("Retry-After", String(rl.retryAfter));
      res.headers.set("X-RateLimit-Limit", String(rl.limit));
      res.headers.set("X-RateLimit-Remaining", "0");
      res.headers.set("X-RateLimit-Reset", String(Math.ceil(rl.resetAt / 1000)));
      applySecurityHeaders(res);
      return res;
    }

    // Continue with rate limit headers on success
    const res = NextResponse.next();
    res.headers.set("X-RateLimit-Limit", String(rl.limit));
    res.headers.set("X-RateLimit-Remaining", String(rl.remaining));
    res.headers.set("X-RateLimit-Reset", String(Math.ceil(rl.resetAt / 1000)));
    applySecurityHeaders(res);
    return res;
  }

  // --- Non-API routes: just add security headers ---
  const res = NextResponse.next();
  applySecurityHeaders(res);
  return res;
}

export const config = {
  matcher: [