Initial commit - Prode Mundial 2026

app/middleware.ts

@@ -0,0 +1,43 @@
+import { NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
+import { jwtVerify } from 'jose'
+
+const secret = new TextEncoder().encode(
+  process.env.JWT_SECRET ?? 'fallback_secret_change_in_production'
+)
+
+const PUBLIC_PATHS = ['/login', '/register', '/api/auth/login', '/api/auth/register']
+
+export async function middleware(request: NextRequest) {
+  const { pathname } = request.nextUrl
+
+  if (PUBLIC_PATHS.some(p => pathname.startsWith(p))) {
+    return NextResponse.next()
+  }
+
+  const token = request.cookies.get('prode_token')?.value
+
+  if (!token) {
+    return NextResponse.redirect(new URL('/login', request.url))
+  }
+
+  try {
+    const { payload } = await jwtVerify(token, secret)
+
+    if (pathname.startsWith('/admin') || pathname.startsWith('/api/admin')) {
+      if (payload.role !== 'ADMIN') {
+        return NextResponse.redirect(new URL('/predictions', request.url))
+      }
+    }
+
+    return NextResponse.next()
+  } catch {
+    return NextResponse.redirect(new URL('/login', request.url))
+  }
+}
+
+export const config = {
+  matcher: [
+    '/((?!_next/static|_next/image|favicon.ico|.*\\.png|.*\\.jpg|.*\\.svg).*)',
+  ],
+}