Next.js 16 Middleware — Missing matcher Caused Auth Check on Every Static File (12x CPU)

// ============================================
// Middleware Matcher Configuration
// NEVER deploy middleware without a matcher
// ============================================

// BAD: No matcher — runs on EVERY request
// export { default } from 'next-auth/middleware'

export { default } from 'next-auth/middleware'

// BAD: Too broad matcher — only excludes _next/static
// Still runs on API routes, images, fonts, etc.
export const config = {
  matcher: ['/((?!_next/static).*)']
}

// GOOD: Explicit protected paths can run middleware on routes that need it
export const config = {
  matcher: [
    '/account/:path*',
    '/checkout/:path*',
    '/admin/:path*',
    '/api/orders/:path*',
  ]
}

// BETTER: Exclude all static and public assets
// This runs middleware on all routes EXCEPT listed paths
export const config = {
  matcher: [
    /*
     * Match all request paths except:
     * - _next/static (static files)
     * - _next/image (image optimization files)
     * - favicon.ico (favicon file)
     * - public directory files
     * - api/auth (NextAuth.js API routes — handles its own auth)
     */
    '/((?!api/auth|_next/static|_next/image|favicon.ico|images|fonts).*)',
  ]
}

// BEST: Use explicit path list when possible
// Faster to evaluate and easier to audit
export const config = {
  matcher: [
    '/account/:path*',
    '/checkout/:path*',
    '/admin/:path*',
    '/api/protected/:path*',
  ]
}

// ============================================
// Middleware Rewrite with Geolocation
// ============================================

// middleware.ts
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export function middleware(request: NextRequest) {
  const { nextUrl, geo } = request

  // Skip for excluded paths
  if (
    nextUrl.pathname.startsWith('/_next') ||
    nextUrl.pathname.startsWith('/api') ||
    nextUrl.pathname === '/favicon.ico'
  ) {
    return
  }

  // Geolocation-based rewrite for product pages
  // geo.country is available on Vercel Edge, Cloudflare Workers
  if (nextUrl.pathname.startsWith('/products/') && geo?.country) {
    const country = geo.country.toLowerCase()
    const localeMap: Record<string, string> = {
      us: 'en-US',
      gb: 'en-GB',
      de: 'de-DE',
      fr: 'fr-FR',
      jp: 'ja-JP',
    }

    const locale = localeMap[country] || 'en-US'

    // Rewrite the URL with locale — user sees /products/shoe
    // but the app renders /products/shoe?locale=en-US
    const url = nextUrl.clone()
    url.searchParams.set('locale', locale)

    return NextResponse.rewrite(url)
  }

  // A/B testing variant assignment
  if (nextUrl.pathname === '/pricing') {
    const cookie = request.cookies.get('ab-test-variant')
    let variant = cookie?.value

    if (!variant) {
      variant = Math.random() < 0.5 ? 'A' : 'B'
      const response = NextResponse.next()
      response.cookies.set('ab-test-variant', variant, {
        maxAge: 60 * 60 * 24 * 30, // 30 days
      })
      return response
    }

    if (variant === 'B') {
      const url = nextUrl.clone()
      url.pathname = '/pricing-v2'
      return NextResponse.rewrite(url)
    }
  }
}

export const config = {
  matcher: [
    '/((?!_next/static|_next/image|favicon.ico).*)',
  ]
}

// ============================================
// next.config.js redirects (higher priority)
// ============================================

import type { NextConfig } from 'next'

const nextConfig: NextConfig = {
  async redirects() {
    return [
      // Static redirect — evaluated at CDN level, no Edge Runtime
      {
        source: '/old-products',
        destination: '/products',
        permanent: true, // 301 — cached by browsers/SEOs
      },
      {
        source: '/old-blog/:slug',
        destination: '/blog/:slug',
        permanent: true,
      },
    ]
  },
}

export default nextConfig

// ============================================
// middleware.ts redirects (lower priority, dynamic)
// ============================================

// middleware.ts
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export function middleware(request: NextRequest) {
  const { nextUrl } = request

  // Auth redirect — runs on Edge Runtime, checks session
  const sessionToken = request.cookies.get('session-token')
  const isProtectedPath = nextUrl.pathname.startsWith('/account')

  if (isProtectedPath && !sessionToken) {
    const loginUrl = nextUrl.clone()
    loginUrl.pathname = '/login'
    loginUrl.searchParams.set('redirect', nextUrl.pathname)
    return NextResponse.redirect(loginUrl)
  }

  // Maintenance mode redirect — checks feature flag
  if (
    nextUrl.pathname === '/checkout' &&
    process.env.MAINTENANCE_MODE === 'true'
  ) {
    return NextResponse.redirect(new URL('/maintenance', nextUrl))
  }
}

export const config = {
  matcher: ['/account/:path*', '/checkout']
}

// ============================================
// Geolocation to Header Pattern
// ============================================

// middleware.ts
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export function middleware(request: NextRequest) {
  const { geo, nextUrl } = request

  // Skip non-page requests
  if (
    nextUrl.pathname.startsWith('/_next') ||
    nextUrl.pathname.startsWith('/api')
  ) {
    return NextResponse.next()
  }

  // Vercel/Cloudflare provides geo data
  // Self-hosted: returns undefined
  if (geo?.country) {
    const response = NextResponse.next()

    // Set header for Server Components to read
    response.headers.set('x-geo-country', geo.country)
    response.headers.set('x-geo-city', geo.city || '')
    response.headers.set('x-geo-region', geo.region || '')

    // Set cookie for client-side access
    response.cookies.set('user-country', geo.country, {
      maxAge: 60 * 60 * 24, // 24 hours
      httpOnly: false, // Allow JS access for analytics
      sameSite: 'lax',
    })

    return response
  }

  return NextResponse.next()
}

// app/page.tsx — read geolocation from header
import { headers } from 'next/headers'

export default async function HomePage() {
  const headersList = await headers()
  const country = headersList.get('x-geo-country') || 'US'

  return (
    <div>
      <p>Your country: {country}</p>
      {/* Country-specific content */}
    </div>
  )
}

export const config = {
  matcher: [
    '/((?!_next/static|_next/image|favicon.ico).*)',
  ]
}

// ============================================
// BAD: Session refresh in middleware
// ============================================

// DON'T DO THIS — blocks every matching request
export async function middleware(request: NextRequest) {
  const token = request.cookies.get('session')

  if (token) {
    // This external call blocks every request for 200ms
    const refreshed = await fetch('https://auth.example.com/refresh', {
      method: 'POST',
      headers: { 'Authorization': `Bearer ${token.value}` }
    })

    if (refreshed.ok) {
      const { newToken } = await refreshed.json()
      const response = NextResponse.next()
      response.cookies.set('session', newToken, { maxAge: 3600 })
      return response
    }
  }

  return NextResponse.next()
}

// ============================================
// GOOD: Session check only — refresh deferred
// ============================================

// middleware.ts
export async function middleware(request: NextRequest) {
  const { nextUrl } = request

  // Only check protected paths
  const protectedPaths = ['/account', '/checkout', '/orders']
  const isProtected = protectedPaths.some(
    path => nextUrl.pathname.startsWith(path)
  )

  if (!isProtected) return NextResponse.next()

  const token = request.cookies.get('session')

  if (!token) {
    // No token at all — redirect to login
    const loginUrl = nextUrl.clone()
    loginUrl.pathname = '/login'
    loginUrl.searchParams.set('redirect', nextUrl.pathname)
    return NextResponse.redirect(loginUrl)
  }

  // Token exists — let the page handle validation/refresh
  // This is fast (<1ms) because we only read a cookie
  return NextResponse.next()
}

// app/account/page.tsx — handles actual session validation
import { refreshSession } from '@/lib/auth'

export default async function AccountPage() {
  const session = await refreshSession()
  // This runs in Server Components — no Edge Runtime timeout issues
  
  if (!session.isValid) {
    // Handle expired/invalid session
    return <RedirectToLogin />
  }

  return <AccountContent session={session} />
}

// ============================================
// Testing the rewrite chain
// ============================================

// next.config.ts
// Add logging to understand the rewrite chain

const nextConfig: NextConfig = {
  async rewrites() {
    return {
      beforeFiles: [
        // Stage 1: beforeFiles — runs before middleware
        {
          source: '/admin-old',
          destination: '/admin',
        },
      ],
      afterFiles: [
        // Stage 3: afterFiles — runs after middleware
        {
          source: '/products/:path*',
          destination: '/catalog/:path*',
        },
      ],
      fallback: [
        // Stage 5: fallback — no route matched
        {
          source: '/:path*',
          destination: '/not-found',
        },
      ],
    }
  },
}

// middleware.ts — runs between beforeFiles and afterFiles
// If middleware rewrites /products to /catalog:
// - The rewrite happens after any beforeFiles rewrite
// - The new URL (/catalog) goes through afterFiles rewrites
// - afterFiles can further rewrite /catalog to something else

export function middleware(request: NextRequest) {
  const { nextUrl } = request

  // This runs after beforeFiles, before afterFiles
  if (nextUrl.pathname.startsWith('/admin')) {
    // Check admin access — redirect to login if not authorized
    const isAdmin = request.cookies.get('admin-token')
    if (!isAdmin) {
      return NextResponse.redirect(new URL('/login', nextUrl))
    }
  }

  return NextResponse.next()
}

// ============================================
// Edge Runtime API Compatibility
// ============================================

// ❌ NOT AVAILABLE in Edge Runtime:
// import { PrismaClient } from '@prisma/client' // TCP/Unix sockets
// import { sign, verify } from 'jsonwebtoken' // Node.js crypto
// import { readFile } from 'fs/promises' // Filesystem
// import crypto from 'crypto' // Node.js crypto module
// import path from 'path' // Node.js path module

// ✅ AVAILABLE in Edge Runtime:
import { jwtVerify } from 'jose' // Web Crypto API compatible
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export async function middleware(request: NextRequest) {
  const token = request.cookies.get('session')?.value

  if (token) {
    try {
      // jose uses Web Crypto API — works on Edge
      const { payload } = await jwtVerify(
        token,
        new TextEncoder().encode(process.env.JWT_SECRET!)
      )

      // Forward user info via header
      const response = NextResponse.next()
      response.headers.set('x-user-id', payload.sub as string)
      return response
    } catch {
      // Token invalid — continue without user context
      // Actual redirect handled by page component
      return NextResponse.next()
    }
  }

  return NextResponse.next()
}

export const config = {
  matcher: ['/account/:path*', '/checkout/:path*']
}