labre-web/src/middleware.ts

import { defineMiddleware } from 'astro:middleware';
import { serverClient } from '@/lib/supabase';

const UABC_DOMAIN = '@uabc.edu.mx';
const PUBLIC_ROUTES = ['/login', '/api/auth/signin', '/api/auth/callback', '/api/auth/signout'];

export const onRequest = defineMiddleware(async (context, next) => {
  const supabase = serverClient(context.cookies);
  context.locals.supabase = supabase;

  const { data: { user } } = await supabase.auth.getUser();

  if (user && !user.email?.toLowerCase().endsWith(UABC_DOMAIN)) {
    await supabase.auth.signOut();
    return context.redirect('/login?error=dominio');
  }

  context.locals.user = user;
  context.locals.profile = null;

  if (user) {
    const { data: profile } = await supabase
      .from('profiles')
      .select('id, email, nombre, matricula, rol, semestre, tutor_id, foto_path')
      .eq('id', user.id)
      .maybeSingle();
    context.locals.profile = profile ?? null;
  }

  const { pathname } = context.url;
  const isPublic = PUBLIC_ROUTES.includes(pathname);

  if (!user && !isPublic) {
    return context.redirect('/login');
  }

  if (user && pathname === '/login') {
    return context.redirect('/');
  }

  if (pathname.startsWith('/admin') && context.locals.profile?.rol !== 'admin') {
    return context.rewrite('/403');
  }

  return next();
});