Protected Routes & Middleware

async function initClerkMiddleware() {
  if (!clerkMiddlewareInstance) {
    try {
      const { clerkMiddleware, createRouteMatcher } = await import(
        '@clerk/nextjs/server'
      )

      // Define public routes that don't require authentication
      const isPublicRoute = createRouteMatcher([
        '/login(.*)',
        '/register(.*)',
        '/privacy(.*)',
        '/terms(.*)',
        '/imprint(.*)',
        '/payment/(.*)',
        '/email-preview(.*)',
        '/logout(.*)',
        '/api/health(.*)',
        '/api/pricing(.*)',
        '/api/webhooks/lemonsqueezy(.*)',
        '/api/webhooks/resend(.*)',
        '/api/webhooks/clerk(.*)',
        '/robots.txt',
        '/sitemap.xml',
      ])

      clerkMiddlewareInstance = clerkMiddleware(
        async (auth, req: NextRequest) => {
          // Public routes: Auth state is available but not required
          // This allows pages to check userId for optional redirects
          if (isPublicRoute(req)) {
            // Don't protect, but auth state is still set by clerkMiddleware
            return
          }

          // Protect all other routes (dashboard, API endpoints, etc.)
          // v6: auth.protect() is now a property, not a method call
          await auth.protect()
        }
      )
    } catch (error) {
      console.warn('Failed to initialize Clerk middleware:', error)
      clerkMiddlewareInstance = (_request: NextRequest) => NextResponse.next()
    }
  }
  return clerkMiddlewareInstance
}

// Main middleware function with security enhancements
async function middleware(request: NextRequest) {
  // Always bypass in test/CI environments
  if (isTestEnvironment()) {
    return NextResponse.next()
  }

  try {
    // 1. Handle CORS preflight requests first
    const corsResponse = corsMiddleware(request)
    if (corsResponse) {
      // Preflight request handled, return immediately
      return corsResponse
    }

let clerkMiddlewareInstance: any = null

async function initClerkMiddleware() {
  if (!clerkMiddlewareInstance) {
    const { clerkMiddleware, createRouteMatcher } = await import('@clerk/nextjs/server')
    // ... configure and cache
  }
  return clerkMiddlewareInstance
}

// src/app/api/my-endpoint/route.ts
import { getServerAuth } from '@/lib/auth/server-helpers'
import { NextRequest, NextResponse } from 'next/server'

export async function GET(request: NextRequest) {
  const { userId } = await getServerAuth()

  if (!userId) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  // Your protected logic here
  return NextResponse.json({ message: 'Hello', userId })
}

export default async function DashboardLayout({
  children,
}: {
  children: React.ReactNode
}) {
  const layoutStart = performance.now()
  console.log('[PERF] Dashboard Layout start')

  let userId: string | null = null

  // Only attempt Clerk calls if not in test/CI environment
  if (!shouldBypassClerk()) {
    try {
      const clerkImportStart = performance.now()
      // Dynamic import to avoid bundling Clerk in test environments
      const { currentUser } = await import('@clerk/nextjs/server')
      console.log(
        '[PERF] Clerk import took:',
        (performance.now() - clerkImportStart).toFixed(2),
        'ms'
      )

      const clerkUserStart = performance.now()
      const user = await currentUser()
      console.log(
        '[PERF] Clerk currentUser() took:',
        (performance.now() - clerkUserStart).toFixed(2),
        'ms'
      )

      // Get database user ID for prefetching
      if (user?.id) {
        const dbUserStart = performance.now()
        const dbUser = await userRepository.findByClerkId(user.id)
        console.log(
          '[PERF] DB user lookup took:',
          (performance.now() - dbUserStart).toFixed(2),
          'ms'
        )
        userId = dbUser?.id || null
      }
    } catch (error) {
      // Only log in development to keep build output clean
      if (process.env.NODE_ENV === 'development') {
        console.warn('Could not fetch current user, using demo mode:', error)
      }
    }
  } else {
    // Test mode: Use test user
    const testUserStart = performance.now()
    const dbUser = await userRepository.findByClerkId(testUser.id)
    console.log(
      '[PERF] Test user lookup took:',
      (performance.now() - testUserStart).toFixed(2),
      'ms'
    )
    userId = dbUser?.id || null
  }

import { withRateLimit } from '@/lib/security/rate-limit-middleware'

export const POST = withRateLimit('api', async (request: NextRequest) => {
  // Auth is already verified by middleware + rate limiter
  // Your handler logic here
})