toanhoang
65029480a9
middleware.ts gates page routes by default (redirect to /login when unauthenticated), except /login itself and Next.js internal asset paths - config.matcher excludes /api entirely, /_next/static, /_next/image, and favicon.ico. Default-deny: everything requires login unless explicitly excluded, including the home page, rather than an opt-in allowlist new routes could forget to join. Builds its own lightweight NextAuth instance from auth.config.ts (no Credentials provider) instead of importing auth from auth.ts, to stay Edge-Runtime compatible - see auth.config.ts. API routes are deliberately NOT gated here (config.matcher excludes /api). Auth.js guidance is to verify the session as close to the data fetching as possible rather than rely on middleware alone; API route auth is added directly in each route handler instead (next commit). This project pins Next.js 14.2.35, which predates the Next.js 16 middleware.ts -> proxy.ts rename, so this stays middleware.ts with a default export, not proxy.ts.