Refactor login flow with reset token support

src/proxy.ts

@@ -0,0 +1,50 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getIronSession } from "iron-session";
+import type { SessionData } from "@/lib/auth";
+import { prisma } from "@/lib/db";
+
+const sessionOptions = {
+  password:
+    process.env.SESSION_SECRET ||
+    "dev-session-secret-change-in-production-must-be-32-chars",
+  cookieName: "study-app-session",
+};
+
+const publicPaths = ["/login", "/api/auth", "/shared"];
+
+export async function proxy(request: NextRequest) {
+  const { pathname } = request.nextUrl;
+
+  if (publicPaths.some((path) => pathname.startsWith(path))) {
+    return NextResponse.next();
+  }
+
+  if (
+    pathname.startsWith("/_next") ||
+    pathname.startsWith("/favicon") ||
+    pathname.includes(".")
+  ) {
+    return NextResponse.next();
+  }
+
+  const response = NextResponse.next();
+  const session = await getIronSession<SessionData>(request, response, sessionOptions);
+  const generationSetting = await prisma.setting.findUnique({
+    where: { key: "auth_session_generation" },
+  });
+  const currentGeneration = Number.parseInt(generationSetting?.value ?? "1", 10);
+
+  if (
+    !session.isAuthenticated ||
+    session.sessionGeneration !== currentGeneration
+  ) {
+    session.destroy();
+    return NextResponse.redirect(new URL("/login", request.url));
+  }
+
+  return response;
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};