proxy.ts

import { NextRequest, NextResponse } from 'next/server';

import { applyRateLimit } from '@/lib/rate-limit';

// Layouts own auth redirects; nothing auth-related has to precede rendering.
export async function proxy(request: NextRequest): Promise<NextResponse> {
  // Skipped in dev, where every request would land in one 'unknown' bucket.
  if (process.env.NODE_ENV !== 'development') {
    const limited = applyRateLimit(request);
    if (limited) return limited;
  }

  // Server Components have no direct access to the request URL, so forward the
  // requested path+query on a header — app/(main)/(auth)/layout.tsx reads it to
  // preserve the destination when redirecting nameless users to /login.
  const requestHeaders = new Headers(request.headers);
  requestHeaders.set(
    'x-current-path',
    request.nextUrl.pathname + request.nextUrl.search,
  );
  return NextResponse.next({ request: { headers: requestHeaders } });
}

export const config = {
  matcher: [
    {
      // Next internals, public assets, and /429 itself must bypass auth + rate limiting.
      source:
        '/((?!_next/static|_next/image|favicon.ico|icon|logo-dark.svg|logo-light.svg|apple-icon|sitemap.xml|robots.txt|429).*)',
      // Only proxy sees these prefetch headers (stripped after); skip here or
      // every speculative Link prefetch burns real-navigation rate-limit budget.
      missing: [
        { type: 'header', key: 'next-router-prefetch' },
        { type: 'header', key: 'purpose', value: 'prefetch' },
      ],
    },
  ],
};