middleware.ts

import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export const config = {
  matcher: [
    /*
     * Match all request paths except for the ones starting with:
     * - api (API routes)
     * - _next/static (static files)
     * - _next/image (image optimization files)
     * - favicon.ico (favicon file)
     * - public files (images, fonts, etc.)
     */
    '/((?!api|_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
  ],
};

export function middleware(req: NextRequest) {
  const url = req.nextUrl;
  
  // Get the hostname (e.g., join.yourdomain.com or admin.yourdomain.com)
  // We use headers.get('host') to support local testing (localhost:3000)
  const hostname = req.headers.get('host') || '';

  // Get the configured join domain from environment variables
  // Example: NEXT_PUBLIC_JOIN_DOMAIN=join.yourchurch.com
  const joinDomain = process.env.NEXT_PUBLIC_JOIN_DOMAIN;

  const isJoinPortal = process.env.NEXT_PUBLIC_IS_JOIN_PORTAL === 'true';

  // If this Vercel project is designated as the Public Join Portal
  if (isJoinPortal || (joinDomain && hostname === joinDomain)) {
    // 1. If they visit the root path "/", rewrite to "/join"
    if (url.pathname === '/') {
      return NextResponse.rewrite(new URL('/join', req.url));
    }
    
    // 2. Prevent access to the admin dashboard.
    // If they try to access any path other than "/join", redirect them back to the root
    if (url.pathname !== '/join') {
      return NextResponse.redirect(new URL('/', req.url));
    }
  }

  // Optional: If you want to block access to "/join" on the admin domain
  // so people ONLY use the public domain, you can uncomment this block:
  /*
  if (joinDomain && hostname !== joinDomain && url.pathname === '/join') {
    // Redirect them to the correct public join domain
    return NextResponse.redirect(`https://${joinDomain}`);
  }
  */

  return NextResponse.next();
}