Epicure/apps/web/middleware.ts

import { NextRequest, NextResponse } from "next/server";
import { getSessionCookie } from "better-auth/cookies";

// Guards the (app) and admin route groups. This only checks for the
// presence/validity-shape of the Better Auth session cookie — it does NOT
// hit the DB. Per-route handlers (and the admin layout) still perform the
// authoritative session/role checks server-side; this is a fast redirect
// for the common unauthenticated case.
export function middleware(request: NextRequest) {
  const sessionCookie = getSessionCookie(request);

  if (!sessionCookie) {
    const loginUrl = new URL("/login", request.url);
    loginUrl.searchParams.set("redirect", request.nextUrl.pathname);
    return NextResponse.redirect(loginUrl);
  }

  return NextResponse.next();
}

export const config = {
  matcher: [
    "/recipes/:path*",
    "/explore",
    "/search",
    "/settings/:path*",
    "/feed",
    "/pantry",
    "/messages/:path*",
    "/shopping-lists/:path*",
    "/u/:path*",
    "/people/:path*",
    "/collections/:path*",
    "/meal-plan/:path*",
    "/admin/:path*",
  ],
};