import { withSecurityHeaders } from "@repo/core-shared/security/next";
import type { NextRequest, NextResponse } from "next/server";

// Payload's admin UI is served by this Next.js app and is always dynamically
// rendered, so the shared nonce-based middleware works here: it generates a
// per-request nonce, threads it into the CSP, and sets the CSP on the
// forwarded request headers — which is how Next propagates the nonce onto
// the admin's scripts. Without a nonce, the prod CSP's `strict-dynamic`
// script-src would block every Payload admin script.
export function middleware(request: NextRequest): NextResponse {
  return withSecurityHeaders(request);
}

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};