// middleware.ts
import { inaiAuthMiddleware } from "@inai-dev/nextjs/middleware";

export default inaiAuthMiddleware({
  publicRoutes: ["/", "/about", "/login"],
  signInUrl: "/login",
  // jwksUrl: "https://apiauth.inai.dev/.well-known/jwks.json", // optional override
});

export const config = { matcher: ["/((?!_next|static|favicon.ico).*)"] };

// app/api/auth/[...inai]/route.ts
import { createAuthRoutes } from "@inai-dev/nextjs/server";

export const { GET, POST } = createAuthRoutes();

import { auth } from "@inai-dev/nextjs/server";

export default async function Dashboard() {
  const { userId, has, protect, redirectToSignIn, getToken } = await auth();

  // Check if user is authenticated
  if (!userId) {
    redirectToSignIn({ returnTo: "/dashboard" });
  }

  // Check roles/permissions
  if (has({ role: "admin" })) {
    // admin-only logic
  }

  // Protect — throws redirect if unauthorized
  const authed = protect({ permission: "posts:write" });

  // Get the access token
  const token = await getToken();

  return <p>User: {userId}</p>;
}

import { currentUser } from "@inai-dev/nextjs/server";

export default async function Profile() {
  const user = await currentUser();
  if (!user) return null;

  return <p>{user.email}</p>;
}

// Force a fresh fetch from the API (bypasses cached session)
const freshUser = await currentUser({ fresh: true });

const { isLoaded, isSignedIn, userId, roles, permissions, has, signOut } = useAuth();

has({ role: "admin" });       // check role
has({ permission: "read" });  // check permission
await signOut();

const { isLoaded, isSignedIn, user } = useUser();
// user: UserResource | null

const { isLoaded, isSignedIn, userId, tenantId, orgId, orgRole } = useSession();

const { isLoaded, orgId, orgRole } = useOrganization();

const { signIn, isLoading, error, status, reset } = useSignIn();

await signIn.create({ identifier: "user@example.com", password: "..." });
// status: "idle" | "loading" | "needs_mfa" | "complete" | "error"

// MFA flow
await signIn.attemptMFA({ code: "123456" });

const { signUp, isLoading, error, status, reset } = useSignUp();

await signUp.create({
  email: "user@example.com",
  password: "...",
  firstName: "Jane",
  lastName: "Doe",
});
// status: "idle" | "loading" | "needs_email_verification" | "complete" | "error"

import { configureAuth, getAuthConfig } from "@inai-dev/nextjs/server";

configureAuth({
  signInUrl: "/login",
  signUpUrl: "/register",
  afterSignInUrl: "/dashboard",
  afterSignOutUrl: "/",
  publishableKey: "pk_live_...",
});

const config = getAuthConfig();
// { signInUrl, signUpUrl, afterSignInUrl, afterSignOutUrl, publishableKey }

import { createRouteMatcher } from "@inai-dev/nextjs/middleware";

const isPublic = createRouteMatcher(["/", "/about", "/api/(.*)"]);
const isAdmin = createRouteMatcher(["/admin(.*)"]);

import { withInAIAuth } from "@inai-dev/nextjs/middleware";

export default withInAIAuth(
  (req) => {
    // Your custom middleware logic
    return NextResponse.next();
  },
  {
    publicRoutes: ["/", "/login"],
    signInUrl: "/login",
    beforeAuth: (req) => {
      // Runs before auth check
    },
    afterAuth: (auth, req) => {
      // Runs after auth check
      if (auth.userId && req.nextUrl.pathname === "/login") {
        return NextResponse.redirect(new URL("/dashboard", req.url));
      }
    },
  }
);

import type {
  AuthObject,
  ServerAuthObject,
  ProtectedAuthObject,
  UserResource,
  PlatformUserResource,
  SessionResource,
  OrganizationResource,
  InAIAuthConfig,
  InAIAuthErrorBody,
  SignInResult,
  SignUpResult,
} from "@inai-dev/nextjs";

import type {
  InAIMiddlewareConfig,
} from "@inai-dev/nextjs/middleware";