Function proxy

apps/web/proxy.ts:228–424

(req: NextRequest)

}

export default async function proxy(req: NextRequest) {
  const instance = await getInstanceInfo()
  const { pathname, search } = req.nextUrl
  const fullhost = req.headers.get('host')

  // -------------------------------------------------------------------------
  // 1. Admin subdomain (multi only) → rewrite to /admin route group.
  //    Idempotent: if the path already starts with /admin (e.g. internal nav
  //    uses /admin/organizations so it works in both subdomain and path mode),
  //    don't double-prefix.
  // -------------------------------------------------------------------------
  if (await isAdminSubdomain(fullhost, instance)) {
    const target = pathname === '/admin' || pathname.startsWith('/admin/')
      ? pathname
      : `/admin${pathname}`
    const response = NextResponse.rewrite(new URL(`${target}${search}`, req.url))
    setInstanceCookies(response, instance)
    return response
  }

  // -------------------------------------------------------------------------
  // 1b. Admin path — direct /admin access works in any tenancy mode.
  //     In single mode this is the only way to reach the admin panel; in
  //     multi mode it's an alternative to the admin.{domain} subdomain.
  // -------------------------------------------------------------------------
  if (pathname === '/admin' || pathname.startsWith('/admin/')) {
    const response = NextResponse.rewrite(new URL(`${pathname}${search}`, req.url))
    setInstanceCookies(response, instance)
    return response
  }

  // -------------------------------------------------------------------------
  // 1b. Admin path — direct /admin access works in any tenancy mode.
  //     In single mode this is the only way to reach the admin panel; in
  //     multi mode it's an alternative to the admin.{domain} subdomain.
  // -------------------------------------------------------------------------
  if (pathname === '/admin' || pathname.startsWith('/admin/')) {
    const response = NextResponse.rewrite(new URL(`${pathname}${search}`, req.url))
    setInstanceCookies(response, instance)
    return response
  }

  // -------------------------------------------------------------------------
  // 2. Standard out-of-org paths
  // -------------------------------------------------------------------------
  if (pathname === '/home') {
    return NextResponse.rewrite(new URL(`${pathname}${search}`, req.url))
  }

  // -------------------------------------------------------------------------
  // 3. Auth pages — resolve tenant for cookie context, rewrite to /auth
  // -------------------------------------------------------------------------
  const authPaths = ['/login', '/signup', '/reset', '/forgot', '/verify-email']
  if (authPaths.includes(pathname)) {
    const resolved = await resolveTenant(req, instance)
    const requestHeaders = tenantRequestHeaders(req, resolved, instance)
    const response = NextResponse.rewrite(
      new URL(`/auth${pathname}${search}`, req.url),