import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

// Regional content mapping
const regionConfig = {
  US: { currency: 'USD', locale: 'en-US', site: 'us' },
  GB: { currency: 'GBP', locale: 'en-GB', site: 'uk' },
  DE: { currency: 'EUR', locale: 'de-DE', site: 'eu' },
  FR: { currency: 'EUR', locale: 'fr-FR', site: 'eu' },
  IN: { currency: 'INR', locale: 'en-IN', site: 'in' },
  JP: { currency: 'JPY', locale: 'ja-JP', site: 'jp' },
  DEFAULT: { currency: 'USD', locale: 'en-US', site: 'intl' },
}

const EU_COUNTRIES = ['DE', 'FR', 'ES', 'IT', 'NL', 'BE', 'AT', 'IE', 'PT', 'SE', 'DK', 'FI', 'PL']

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl
  const country = (request.geo?.country || request.headers.get('x-vercel-ip-country') || '').toUpperCase()

  // Skip middleware for static files and API routes
  if (pathname.startsWith('/_next') || pathname.startsWith('/api/')) {
    return NextResponse.next()
  }

  // Get region config
  const config = regionConfig[country as keyof typeof regionConfig] || regionConfig.DEFAULT

  // Set regional cookies
  const response = NextResponse.next()
  response.cookies.set('currency', config.currency, { maxAge: 3600 * 24, path: '/' })
  response.cookies.set('locale', config.locale, { maxAge: 3600 * 24, path: '/' })

  // GDPR check for EU visitors
  if (EU_COUNTRIES.includes(country) && !request.cookies.has('gdpr_consent')) {
    response.headers.set('x-show-gdpr-banner', 'true')
  }

  // Regional pricing page redirect (if not already on the right page)
  if (pathname === '/pricing' && !request.cookies.has('region_seen')) {
    response.cookies.set('region_seen', config.site, { maxAge: 3600 * 24 * 30, path: '/' })
  }

  return response
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
}

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

// Tenant configuration (in production, fetch from KV store or database)
const tenantConfig = {
  app: {
    name: 'App Dashboard',
    rewrite: '/dashboard',
    auth: true,
  },
  www: {
    name: 'Marketing Site',
    rewrite: '/marketing',
    auth: false,
  },
  admin: {
    name: 'Admin Panel',
    rewrite: '/admin',
    auth: true,
    role: 'admin',
  },
  docs: {
    name: 'Documentation',
    rewrite: '/docs',
    auth: false,
  },
  blog: {
    name: 'Blog',
    rewrite: '/blog',
    auth: false,
  },
}

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl
  const hostname = request.headers.get('host') || ''
  const subdomain = hostname.split('.')[0]

  // Skip for direct IP or localhost
  if (hostname === 'localhost:3000' || hostname === '127.0.0.1:3000') {
    return NextResponse.next()
  }

  // Find tenant config
  const tenant = tenantConfig[subdomain as keyof typeof tenantConfig]

  if (!tenant) {
    // Unknown subdomain — redirect to main site
    return NextResponse.redirect(new URL('https://www.example.com'))
  }

  // Authentication check for protected tenants
  if (tenant.auth) {
    const session = request.cookies.get('session')
    if (!session) {
      const loginUrl = new URL('/login', request.url)
      loginUrl.searchParams.set('redirect', pathname)
      loginUrl.searchParams.set('tenant', subdomain)
      return NextResponse.redirect(loginUrl)
    }

    // Role-based access for admin
    if (tenant.role) {
      const userRole = request.cookies.get('user_role')?.value
      if (userRole !== tenant.role) {
        return NextResponse.redirect(new URL('/dashboard', request.url))
      }
    }
  }

  // Rewrite to tenant-specific internal route
  const url = request.nextUrl.clone()
  url.pathname = `${tenant.rewrite}${pathname}`
  return NextResponse.rewrite(url)
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
}

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

// ====== SECURITY LAYER ======

const BOT_PATTERNS = [
  'bot', 'crawler', 'spider', 'scraper', 'harvest',
  'curl', 'wget', 'python-requests', 'go-http-client',
]

const ALLOWED_BOTS = ['googlebot', 'bingbot', 'slurp']

function isBot(ua: string): { isBot: boolean; name?: string } {
  const uaLower = ua.toLowerCase()

  for (const bot of ALLOWED_BOTS) {
    if (uaLower.includes(bot)) return { isBot: true, name: bot }
  }

  for (const pattern of BOT_PATTERNS) {
    if (uaLower.includes(pattern)) return { isBot: true, name: pattern }
  }

  return { isBot: false }
}

// ====== GEO LAYER ======

interface GeoConfig {
  currency: string
  locale: string
  domain: string
  gdprRequired: boolean
}

const geoConfigs: Record<string, GeoConfig> = {
  US: { currency: 'USD', locale: 'en-US', domain: 'example.com', gdprRequired: false },
  GB: { currency: 'GBP', locale: 'en-GB', domain: 'example.co.uk', gdprRequired: false },
  DE: { currency: 'EUR', locale: 'de-DE', domain: 'example.de', gdprRequired: true },
  FR: { currency: 'EUR', locale: 'fr-FR', domain: 'example.fr', gdprRequired: true },
  DEFAULT: { currency: 'USD', locale: 'en-US', domain: 'example.com', gdprRequired: false },
}

function getGeoConfig(request: NextRequest): GeoConfig {
  const country = (request.geo?.country || '').toUpperCase()
  return geoConfigs[country] || geoConfigs.DEFAULT
}

// ====== DEVICE LAYER ======

function isMobile(ua: string): boolean {
  return /mobile|android|iphone|ipad|ipod|blackberry|windows phone/i.test(ua)
}

// ====== FEATURE FLAGS ======

const featureFlags = {
  newCheckout: { rollout: 50, cookie: 'ff_new_checkout' },
  darkMode: { rollout: 25, cookie: 'ff_dark_mode' },
  aiSearch: { rollout: 10, cookie: 'ff_ai_search' },
}

function getFeatureFlags(userId: string): Record<string, boolean> {
  const hash = userId.split('').reduce((acc, c) => acc + c.charCodeAt(0), 0)
  const flags: Record<string, boolean> = {}

  for (const [flag, config] of Object.entries(featureFlags)) {
    flags[flag] = (hash % 100) < config.rollout
  }

  return flags
}

// ====== MAIN MIDDLEWARE ======

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl
  const ua = request.headers.get('user-agent') || ''

  // Skip static files
  if (pathname.startsWith('/_next') || pathname === '/favicon.ico') {
    return NextResponse.next()
  }

  // 1. BOT DETECTION
  if (pathname.startsWith('/api/')) {
    const bot = isBot(ua)
    if (bot.isBot && !ALLOWED_BOTS.includes(bot.name || '')) {
      return NextResponse.json(
        { error: 'Access denied', code: 'BOT_DETECTED' },
        { status: 403 }
      )
    }
  }

  // 2. GEO PROCESSING
  const geoConfig = getGeoConfig(request)
  const response = NextResponse.next()

  // Set geo-based cookies
  response.cookies.set('geo_currency', geoConfig.currency, {
    maxAge: 3600 * 24 * 7,
    path: '/',
    sameSite: 'lax',
  })

  response.cookies.set('geo_locale', geoConfig.locale, {
    maxAge: 3600 * 24 * 7,
    path: '/',
    sameSite: 'lax',
  })

  // GDPR banner
  if (geoConfig.gdprRequired && !request.cookies.has('gdpr_consent')) {
    response.headers.set('x-gdpr-required', 'true')
  }

  // 3. DEVICE DETECTION
  if (isMobile(ua)) {
    response.headers.set('x-device-type', 'mobile')
    response.cookies.set('device', 'mobile', {
      maxAge: 3600 * 24,
      path: '/',
    })
  }

  // 4. FEATURE FLAGS
  const userId = request.cookies.get('user_id')?.value || 'anonymous'

  if (!request.cookies.has('ff_initialized')) {
    const flags = getFeatureFlags(userId)
    response.cookies.set('ff_initialized', 'true', {
      maxAge: 3600 * 24,
      path: '/',
    })

    for (const [flag, enabled] of Object.entries(flags)) {
      response.cookies.set(featureFlags[flag as keyof typeof featureFlags].cookie, String(enabled), {
        maxAge: 3600 * 24 * 7,
        path: '/',
      })
    }
  }

  // 5. A/B TESTING FOR CHECKOUT
  if (pathname.startsWith('/checkout') && !request.cookies.has('checkout_variant')) {
    const variant = Math.random() < 0.5 ? 'A' : 'B'
    response.cookies.set('checkout_variant', variant, {
      maxAge: 3600 * 24 * 30,
      path: '/',
    })

    if (variant === 'B') {
      response.headers.set('x-checkout-variant', 'B')
    }
  }

  // 6. SECURITY HEADERS
  response.headers.set('X-Content-Type-Options', 'nosniff')
  response.headers.set('X-Frame-Options', 'DENY')
  response.headers.set('X-XSS-Protection', '1; mode=block')
  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin')

  if (pathname.startsWith('/dashboard/')) {
    response.headers.set('X-Robots-Tag', 'noindex, nofollow')
  }

  return response
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
}

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

declare const process: {
  env: {
    REDIS_URL?: string
    AUTH_API_URL?: string
    MAINTENANCE_MODE?: string
    ENVIRONMENT?: string
  }
}

// ====== DISTRIBUTED RATE LIMITING ======

// In-memory fallback (use Upstash Redis in production)
const rateLimitStore = new Map<string, { count: number; resetTime: number }>()

async function checkRateLimit(
  key: string,
  maxRequests: number,
  windowMs: number
): Promise<{ allowed: boolean; remaining: number; resetTime: number }> {
  const now = Date.now()
  const record = rateLimitStore.get(key)

  if (!record || now > record.resetTime) {
    rateLimitStore.set(key, { count: 1, resetTime: now + windowMs })
    return { allowed: true, remaining: maxRequests - 1, resetTime: now + windowMs }
  }

  record.count++

  if (record.count > maxRequests) {
    return { allowed: false, remaining: 0, resetTime: record.resetTime }
  }

  return { allowed: true, remaining: maxRequests - record.count, resetTime: record.resetTime }
}

// ====== AUTH SESSION VERIFICATION ======

// Cache auth results to reduce upstream calls
const authCache = new Map<string, { valid: boolean; role: string; expiresAt: number }>()

async function verifySession(token: string): Promise<{ valid: boolean; role: string }> {
  // Check cache first
  const cached = authCache.get(token)
  if (cached && Date.now() < cached.expiresAt) {
    return { valid: cached.valid, role: cached.role }
  }

  try {
    const response = await fetch(`${process.env.AUTH_API_URL}/verify`, {
      headers: { Authorization: `Bearer ${token}` },
      signal: AbortSignal.timeout(2000), // 2 second timeout
    })

    if (!response.ok) return { valid: false, role: '' }

    const data = await response.json()

    // Cache for 5 minutes
    authCache.set(token, {
      valid: data.valid,
      role: data.role,
      expiresAt: Date.now() + 5 * 60 * 1000,
    })

    return { valid: data.valid, role: data.role }
  } catch {
    // Fail open for degraded experience
    return { valid: true, role: 'user' }
  }
}

// ====== GEO AND REGION ROUTING ======

const REGION_CONFIG = {
  NA: { sites: ['US', 'CA', 'MX'], cache: 'na-cache.example.com' },
  EU: { sites: ['DE', 'FR', 'GB', 'ES', 'IT'], cache: 'eu-cache.example.com' },
  APAC: { sites: ['JP', 'AU', 'IN', 'SG'], cache: 'apac-cache.example.com' },
}

function getRegion(country: string): string {
  for (const [region, config] of Object.entries(REGION_CONFIG)) {
    if (config.sites.includes(country)) return region
  }
  return 'NA' // Default to NA
}

// ====== MAIN MIDDLEWARE ======

export async function middleware(request: NextRequest) {
  const { pathname, search } = request.nextUrl
  const ua = request.headers.get('user-agent') || ''
  const ip = request.headers.get('x-forwarded-for') || 'unknown'
  const country = (request.geo?.country || '').toUpperCase()

  const startTime = Date.now()

  // === 1. MAINTENANCE MODE ===
  if (process.env.MAINTENANCE_MODE === 'true' && !pathname.startsWith('/api/health')) {
    return new Response('Under maintenance', {
      status: 503,
      headers: { 'Retry-After': '3600' },
    })
  }

  // === 2. RATE LIMITING ===
  if (pathname.startsWith('/api/')) {
    const { allowed, remaining, resetTime } = await checkRateLimit(
      `api:${ip}`,
      pathname.startsWith('/api/auth') ? 20 : 100,
      60 * 1000
    )

    if (!allowed) {
      return NextResponse.json(
        { error: 'Too many requests' },
        {
          status: 429,
          headers: {
            'Retry-After': String(Math.ceil((resetTime - Date.now()) / 1000)),
            'X-RateLimit-Remaining': '0',
          },
        }
      )
    }

    const response = NextResponse.next()
    response.headers.set('X-RateLimit-Remaining', String(remaining))

    // === 3. AUTH FOR API ROUTES ===
    const authHeader = request.headers.get('authorization')
    if (authHeader?.startsWith('Bearer ')) {
      const token = authHeader.slice(7)
      const session = await verifySession(token)

      if (!session.valid) {
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
      }

      const requestHeaders = new Headers(request.headers)
      requestHeaders.set('x-user-role', session.role)

      return NextResponse.next({
        request: { headers: requestHeaders },
      })
    }

    return response
  }

  // === 4. PAGE ROUTE PROCESSING ===
  const response = NextResponse.next()

  // Region-based cache header
  const region = getRegion(country)
  response.headers.set('X-Region', region)
  response.headers.set('X-Cache-Group', region)

  // Performance monitoring
  const duration = Date.now() - startTime
  response.headers.set('X-Middleware-Time', `${duration}ms`)

  // Security headers
  response.headers.set('Content-Security-Policy',
    "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
  )
  response.headers.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')

  return response
}

export const config = {
  matcher: [
    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp)$).*)',
  ],
}

export async function middleware(request: NextRequest) {
  const country = request.geo?.country || 'US'
  const region = getRegion(country)

  // Set regional config
  const response = NextResponse.next()
  response.cookies.set('region', region, { maxAge: 3600 * 24, path: '/' })

  // A/B test new checkout
  if (request.nextUrl.pathname === '/checkout' && !request.cookies.has('checkout_v')) {
    response.cookies.set('checkout_v', Math.random() < 0.5 ? 'old' : 'new', {
      maxAge: 3600 * 24 * 30, path: '/'
    })
  }

  return response
}

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl

  if (pathname.startsWith('/api/')) {
    const country = request.geo?.country || 'US'

    // Route to nearest regional API
    const regions = {
      EU: 'https://api-eu.example.com',
      NA: 'https://api-na.example.com',
      APAC: 'https://api-apac.example.com',
    }

    const region = getRegion(country)
    const baseUrl = regions[region as keyof typeof regions] || regions.NA

    // Rewrite to regional backend
    const url = new URL(pathname, baseUrl)
    url.search = request.nextUrl.search

    return NextResponse.rewrite(url)
  }

  return NextResponse.next()
}