import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

import { getSanitizedParams } from './lib/utils/domain';

// Change function name from 'middleware' to 'proxy'
export function middleware(request: NextRequest) {
  const { nextUrl } = request;
  const searchParams = nextUrl.searchParams;

  // 1. Robust Parameter Extraction (with sanitization)
  const { franchiseeId, lang } = getSanitizedParams(searchParams);
  const slug = searchParams.get('slug');

  // 2. Handle Slug-based Redirection
  // Handle 'home' paths or slugs specifically by redirecting to the root '/'
  if (nextUrl.pathname === '/home' || slug?.toLowerCase() === 'home') {
    const newUrl = new URL('/', request.url);
    if (franchiseeId) newUrl.searchParams.set('franchiseeId', franchiseeId);
    if (lang) newUrl.searchParams.set('lang', lang);
    newUrl.searchParams.delete('slug'); // Remove the parsed slug manually
    return NextResponse.redirect(newUrl);
  }

  // If a different slug is present, redirect to /{slug} immediately
  if (slug) {
    const newUrl = new URL(`/${slug}`, request.url);
    // Carry over important params
    if (franchiseeId) newUrl.searchParams.set('franchiseeId', franchiseeId);
    if (lang) newUrl.searchParams.set('lang', lang);
    // Note: slug is intentionally dropped after redirect
    return NextResponse.redirect(newUrl);
  }

  // 3. Context Injection (Headers)
  //
  // The URL is the only source of tenant/language context. Anything arriving on
  // these headers is dropped first: they are read back during SSR as trusted
  // context, so a hand-crafted `x-franchisee-id` would otherwise pin the render
  // to someone else's franchise. (The previous reset block built a stripped
  // Headers object but returned a response created before it, so nothing was
  // ever actually removed.)
  const requestHeaders = new Headers(request.headers);
  requestHeaders.delete('x-franchisee-id');
  requestHeaders.delete('x-lang');

  if (franchiseeId) requestHeaders.set('x-franchisee-id', franchiseeId);
  if (lang) requestHeaders.set('x-lang', lang);

  // Layouts don't receive searchParams, so the current location is passed along
  // for the root layout's primary-language redirect.
  requestHeaders.set('x-pathname', nextUrl.pathname);
  requestHeaders.set('x-search', nextUrl.search);

  return NextResponse.next({
    request: {
      headers: requestHeaders,
    },
  });
}

export const config = {
  matcher: [
    '/((?!api|_next/static|_next/image|favicon.ico).*)',
  ],
};