middleware.ts

/**
 * middleware.ts
 * Protects /dashboard/* routes — unauthenticated users are redirected to /auth/login.
 */

import { auth } from "@/lib/auth";
import { NextResponse } from "next/server";

export default auth((req) => {
  const { pathname } = req.nextUrl;

  // If the user is not authenticated and trying to access a protected route
  if (!req.auth) {
    const loginUrl = new URL("/auth/login", req.url);
    loginUrl.searchParams.set("callbackUrl", pathname);
    return NextResponse.redirect(loginUrl);
  }

  // Role-based route protection
  const role = req.auth.user?.role;

  if (pathname.startsWith("/dashboard/org") && role !== "organization") {
    return NextResponse.redirect(new URL("/dashboard/donor", req.url));
  }

  if (pathname.startsWith("/dashboard/donor") && role !== "donor") {
    return NextResponse.redirect(new URL("/dashboard/org", req.url));
  }

  return NextResponse.next();
});

export const config = {
  matcher: ["/dashboard/:path*"],
};