@digilogiclabs/create-saas-app 1.5.1 → 1.5.3

package/src/templates/web/ui-auth-payments-audio/template/middleware.ts

@@ -0,0 +1,68 @@
+import { NextRequest, NextResponse } from 'next/server'
+import { env } from './src/lib/env'
+
+export async function middleware(request: NextRequest) {
+  // Get auth token from cookies
+  const authToken = request.cookies.get('saas-factory-auth-token')?.value
+  const user = request.cookies.get('saas-factory-auth-user')?.value
+  
+  const isAuthenticated = !!(authToken && user)
+  const { pathname } = request.nextUrl
+
+  // Define protected routes
+  const protectedRoutes = ['/dashboard', '/profile', '/settings']
+  const authRoutes = ['/login', '/signup']
+  
+  // Check if the current path is protected
+  const isProtectedRoute = protectedRoutes.some(route => 
+    pathname.startsWith(route)
+  )
+  
+  // Check if the current path is an auth route
+  const isAuthRoute = authRoutes.some(route => 
+    pathname.startsWith(route)
+  )
+
+  // Redirect unauthenticated users from protected routes
+  if (isProtectedRoute && !isAuthenticated) {
+    const loginUrl = new URL('/login', request.url)
+    loginUrl.searchParams.set('from', pathname)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  // Redirect authenticated users from auth routes
+  if (isAuthRoute && isAuthenticated) {
+    const redirectUrl = request.nextUrl.searchParams.get('from') || '/'
+    return NextResponse.redirect(new URL(redirectUrl, request.url))
+  }
+
+  // Add security headers
+  const response = NextResponse.next()
+  
+  // Add CSRF protection headers
+  response.headers.set('X-Frame-Options', 'DENY')
+  response.headers.set('X-Content-Type-Options', 'nosniff')
+  response.headers.set('Referrer-Policy', 'origin-when-cross-origin')
+  
+  // Add CSP header for additional security
+  if (env.NODE_ENV === 'production') {
+    response.headers.set(
+      'Content-Security-Policy',
+      "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://js.stripe.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://api.stripe.com"
+    )
+  }
+  
+  return response
+}
+
+export const config = {
+  matcher: [
+    // Match all request paths except for the ones starting with:
+    // - api (API routes)
+    // - _next/static (static files)
+    // - _next/image (image optimization files)
+    // - favicon.ico (favicon file)
+    // - public folder files
+    '/((?!api|_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
+  ],
+}