From da9fdc25c4f6aad7d6c382a06e2123c5c0c96d25 Mon Sep 17 00:00:00 2001
From: Firman Ramdhani <33869609+firmanramdhani@users.noreply.github.com>
Date: Thu, 1 Oct 2026 13:20:51 +0700
Subject: [PATCH] refactor: add protected route prefixes and update admin path
 in middleware

---
 src/middleware.ts | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/middleware.ts b/src/middleware.ts
index 30ba070..c8aea99 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -2,14 +2,17 @@ import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
 import { decrypt } from '@/lib/auth'
 
-const protectedRoutes = ['/', '/my-orders', '/my-purchases', '/reports', '/profile', '/users']
+const protectedRoutes = ['/', '/my-orders', '/my-purchases', '/reports', '/profile', '/users', '/balances']
+const protectedPrefixes = ['/my-orders/', '/order/', '/settings/']
 const publicRoutes = ['/login', '/register']
 
 export async function middleware(request: NextRequest) {
   const path = request.nextUrl.pathname
 
-  // Also protect dynamic routes like /my-orders/[id]
-  const isProtectedRoute = protectedRoutes.includes(path) || path.startsWith('/my-orders/')
+  const isProtectedRoute = 
+    protectedRoutes.includes(path) || 
+    protectedPrefixes.some(prefix => path.startsWith(prefix))
+  
   const isPublicRoute = publicRoutes.includes(path)
 
   const cookie = request.cookies.get('session')?.value
@@ -23,7 +26,7 @@ export async function middleware(request: NextRequest) {
     return NextResponse.redirect(new URL('/', request.nextUrl))
   }
 
-  if (path.startsWith('/users') && session?.role !== 'superadmin') {
+  if (path.startsWith('/settings') && session?.role !== 'superadmin') {
     return NextResponse.redirect(new URL('/', request.nextUrl))
   }