fix: secure and wire the portfolio admin panel

middleware.ts

@@ -0,0 +1,91 @@
+import { createServerClient } from '@supabase/ssr'
+import { NextResponse, type NextRequest } from 'next/server'
+
+const ADMIN_LOGIN_PATH = '/admin/login'
+const DEFAULT_ADMIN_EMAIL = 'dev.sxhd@gmail.com'
+
+function getAllowedAdminEmails(): string[] {
+  return (process.env.ADMIN_EMAILS ?? process.env.NEXT_PUBLIC_ADMIN_EMAIL ?? DEFAULT_ADMIN_EMAIL)
+    .split(',')
+    .map((email) => email.trim().toLowerCase())
+    .filter(Boolean)
+}
+
+export async function middleware(request: NextRequest) {
+  const { pathname, search } = request.nextUrl
+  const isLoginPage = pathname === ADMIN_LOGIN_PATH
+  const isAdminApi = pathname.startsWith('/api/admin/')
+
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL
+  const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY
+
+  if (!supabaseUrl || !supabaseAnonKey) {
+    if (isAdminApi) {
+      return NextResponse.json(
+        { error: 'Admin services are not configured.' },
+        { status: 503 },
+      )
+    }
+
+    if (!isLoginPage) {
+      const loginUrl = request.nextUrl.clone()
+      loginUrl.pathname = ADMIN_LOGIN_PATH
+      loginUrl.searchParams.set('error', 'configuration')
+      return NextResponse.redirect(loginUrl)
+    }
+
+    return NextResponse.next()
+  }
+
+  let response = NextResponse.next({ request })
+
+  const supabase = createServerClient(supabaseUrl, supabaseAnonKey, {
+    cookies: {
+      getAll() {
+        return request.cookies.getAll()
+      },
+      setAll(cookiesToSet) {
+        cookiesToSet.forEach(({ name, value }) => request.cookies.set(name, value))
+        response = NextResponse.next({ request })
+        cookiesToSet.forEach(({ name, value, options }) =>
+          response.cookies.set(name, value, options),
+        )
+      },
+    },
+  })
+
+  const {
+    data: { user },
+  } = await supabase.auth.getUser()
+
+  const allowedEmails = getAllowedAdminEmails()
+  const isAdmin = Boolean(
+    user &&
+      (user.app_metadata?.role === 'admin' ||
+        (user.email && allowedEmails.includes(user.email.toLowerCase()))),
+  )
+
+  if (isLoginPage && isAdmin) {
+    const dashboardUrl = request.nextUrl.clone()
+    dashboardUrl.pathname = '/admin/dashboard'
+    dashboardUrl.search = ''
+    return NextResponse.redirect(dashboardUrl)
+  }
+
+  if (!isLoginPage && !isAdmin) {
+    if (isAdminApi) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    const loginUrl = request.nextUrl.clone()
+    loginUrl.pathname = ADMIN_LOGIN_PATH
+    loginUrl.searchParams.set('next', `${pathname}${search}`)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  return response
+}
+
+export const config = {
+  matcher: ['/admin/:path*', '/api/admin/:path*'],
+}