echos-ocr/src/middleware.ts

import { NextRequest, NextResponse } from "next/server";
import { getToken } from "next-auth/jwt";

const publicPaths = [
  "/welcome",
  "/features",
  "/pricing",
  "/login",
  "/signup",
  "/invite",
  "/setup",
  "/api/auth",
  "/api/health",
  "/api/setup",
  "/api/onboarding",
  "/api/invitations/verify",
  "/api/jobs/process",
  "/api/email-watch/poll",
  "/api/ftp-watch/poll",
];

const workspaceSetupExemptPaths = [
  "/workspace-setup",
  "/onboarding",
  "/api/onboarding",
  "/api/org/create-personal",
  "/api/org/list",
  "/api/auth",
];

const onboardingExemptPaths = [
  "/onboarding",
  "/api/onboarding",
  "/api/auth",
];

function isPublic(pathname: string) {
  return publicPaths.some(
    (p) => pathname === p || pathname.startsWith(p + "/")
  );
}

function isOnboardingExempt(pathname: string) {
  return onboardingExemptPaths.some(
    (p) => pathname === p || pathname.startsWith(p + "/")
  );
}

export async function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl;

  if (
    pathname.startsWith("/_next") ||
    pathname.startsWith("/favicon") ||
    pathname.includes(".")
  ) {
    return NextResponse.next();
  }

  if (isPublic(pathname)) {
    return NextResponse.next();
  }

  const secureCookie =
    req.headers.get("x-forwarded-proto") === "https" ||
    req.nextUrl.protocol === "https:";
  const token = await getToken({
    req,
    secret: process.env.AUTH_SECRET,
    secureCookie,
  });

  if (!token) {
    if (pathname === "/login" || pathname === "/signup") {
      return NextResponse.next();
    }
    const welcomeUrl = new URL("/welcome", req.url);
    return NextResponse.redirect(welcomeUrl);
  }

  const hasOrg = !!token.orgId;
  const onboardingDone = token.onboardingComplete === true;

  function isWorkspaceSetupExempt(p: string) {
    return workspaceSetupExemptPaths.some(
      (x) => p === x || p.startsWith(x + "/")
    );
  }

  if (!hasOrg && !isWorkspaceSetupExempt(pathname)) {
    return NextResponse.redirect(new URL("/workspace-setup", req.url));
  }

  if (hasOrg && !onboardingDone && !isOnboardingExempt(pathname)) {
    return NextResponse.redirect(new URL("/onboarding", req.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};