From 38dc6efc091315e304fffb63c73b66a24f923afc Mon Sep 17 00:00:00 2001
From: Mathieu <mathieu.fort@gmail.com>
Date: Sun, 7 Jun 2026 00:05:28 +0200
Subject: [PATCH] feat: middleware protection routes + restriction admin
 /parametres

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/middleware.ts | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 src/middleware.ts

diff --git a/src/middleware.ts b/src/middleware.ts
new file mode 100644
index 0000000..90885ea
--- /dev/null
+++ b/src/middleware.ts
@@ -0,0 +1,27 @@
+import { withAuth } from 'next-auth/middleware'
+import { NextResponse } from 'next/server'
+
+export default withAuth(
+  function middleware(req) {
+    const { token } = req.nextauth
+    const { pathname } = req.nextUrl
+
+    // Seuls les admins accèdent à /parametres
+    if (pathname.startsWith('/parametres') && token?.role !== 'admin') {
+      return NextResponse.redirect(new URL('/', req.url))
+    }
+
+    return NextResponse.next()
+  },
+  {
+    callbacks: {
+      authorized: ({ token }) => !!token,
+    },
+  }
+)
+
+export const config = {
+  matcher: [
+    '/((?!login|api/auth|_next/static|_next/image|favicon\\.ico).*)',
+  ],
+}