Next.js Middleware:堅牢な認証と認可の構築

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'
import { verifyJwtToken } from '@/lib/auth' // Your custom JWT verifier

export async function middleware(request: NextRequest) {
  const token = request.cookies.get('auth-token')?.value

  const isAuthPage = request.nextUrl.pathname.startsWith('/login') || 
                     request.nextUrl.pathname.startsWith('/register')

  // 1. Check if token exists and is valid
  const verifiedToken = token && (await verifyJwtToken(token).catch((err) => {
    console.error('Failed to verify token', err)
  }))

  // 2. Redirect unauthenticated users away from protected routes
  if (!verifiedToken) {
    if (!isAuthPage && request.nextUrl.pathname.startsWith('/dashboard')) {
      const loginUrl = new URL('/login', request.url)
      loginUrl.searchParams.set('callbackUrl', request.nextUrl.pathname)
      return NextResponse.redirect(loginUrl)
    }
  }

  // 3. Redirect authenticated users away from auth pages
  if (verifiedToken && isAuthPage) {
    return NextResponse.redirect(new URL('/dashboard', request.url))
  }

  // 4. Pass the request through if all checks pass
  return NextResponse.next()
}

// See "Matching Paths" below
export const config = {
  matcher: ['/dashboard/:path*', '/login', '/register'],
}

// ... previous imports
import { verifyJwtToken } from '@/lib/auth'

export async function middleware(request: NextRequest) {
  const token = request.cookies.get('auth-token')?.value
  const verifiedToken = token && (await verifyJwtToken(token))

  // ... standard auth checks

  // Handle Authorization
  if (verifiedToken) {
    const userRole = verifiedToken.role // Assuming role is encoded in the JWT

    // Protect admin routes
    if (request.nextUrl.pathname.startsWith('/admin')) {
      if (userRole !== 'ADMIN') {
        // User is authenticated, but not authorized
        return NextResponse.redirect(new URL('/unauthorized', request.url))
      }
    }
  }

  return NextResponse.next()
}

export const config = {
  matcher: ['/dashboard/:path*', '/admin/:path*', '/login'],
}

if (verifiedToken) {
  const requestHeaders = new Headers(request.headers)
  requestHeaders.set('x-user-id', verifiedToken.userId)
  
  return NextResponse.next({
    request: {
      headers: requestHeaders,
    },
  })
}

import { headers } from 'next/headers'

export default function DashboardPage() {
  const headersList = headers()
  const userId = headersList.get('x-user-id')

  return <div>Welcome User: {userId}</div>
}