import { type NextRequest, NextResponse } from "next/server";

// Edge proxy (formerly "middleware"): Prisma can't run here, so we only forward
// the request path (so server components / the access guard can read it via
// headers()) and normalize the real client IP. The DB-backed banned/maintenance
// checks happen in src/lib/access-guard.ts (Node runtime) from the root layout.
export function proxy(req: NextRequest) {
  const headers = new Headers(req.headers);
  headers.set("x-pathname", req.nextUrl.pathname);
  const ip =
    req.headers.get("cf-connecting-ip") ??
    req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ??
    req.headers.get("x-real-ip") ??
    "";
  if (ip) headers.set("x-real-client-ip", ip);
  return NextResponse.next({ request: { headers } });
}

export const config = {
  matcher: ["/((?!api|_next/static|_next/image|assets|favicon.ico).*)"],
};