Prepare production deploy for belixa.ru

src/middleware.ts

@@ -1,30 +1,29 @@
-import { NextRequest, NextResponse } from "next/server";
-import { jwtVerify } from "jose";
-
-const JWT_SECRET = new TextEncoder().encode(process.env.JWT_SECRET);
-
-export async function middleware(req: NextRequest) {
-    const token = req.cookies.get("token")?.value;
-    const url = req.nextUrl.clone();
-
-    if (req.nextUrl.pathname.startsWith("/admin") && req.nextUrl.pathname !== "/admin/login") {
-        if (!token) {
-            url.pathname = "/admin/login";
-            return NextResponse.redirect(url);
-        }
-
-        try {
-            const { payload } = await jwtVerify(token, JWT_SECRET);
-            if (payload.role !== "admin") throw new Error();
-        } catch {
-            url.pathname = "/admin/login";
-            return NextResponse.redirect(url);
-        }
-    }
-
-    return NextResponse.next();
-}
-
-export const config = {
-    matcher: ["/admin", "/admin/:path*"],
-};
+import { NextRequest, NextResponse } from 'next/server';
+import { jwtVerify } from 'jose';
+
+export async function middleware(req: NextRequest) {
+    const token = req.cookies.get('token')?.value;
+    const url = req.nextUrl.clone();
+    const jwtSecret = process.env.JWT_SECRET;
+
+    if (req.nextUrl.pathname.startsWith('/admin') && req.nextUrl.pathname !== '/admin/login') {
+        if (!token || !jwtSecret || jwtSecret === 'replace-with-generated-secret') {
+            url.pathname = '/admin/login';
+            return NextResponse.redirect(url);
+        }
+
+        try {
+            const { payload } = await jwtVerify(token, new TextEncoder().encode(jwtSecret));
+            if (payload.role !== 'admin') throw new Error('Invalid role');
+        } catch {
+            url.pathname = '/admin/login';
+            return NextResponse.redirect(url);
+        }
+    }
+
+    return NextResponse.next();
+}
+
+export const config = {
+    matcher: ['/admin', '/admin/:path*'],
+};