admin / Synapse-Sonar

export { default } from "next-auth/middleware";

/**
 * Protects the authenticated app surface. Unauthenticated users hitting these
 * paths are redirected to /login by next-auth. Public routes (/login, /setup,
 * /api/auth, /api/setup, /api/ingest) are intentionally excluded.
 */
export const config = {
  matcher: [
    "/",
    "/integrations/:path*",
    "/admin/:path*",
    "/profile/:path*",
    // protected APIs (ingest + auth + setup stay public)
    "/api/graph/:path*",
    "/api/assets/:path*",
    "/api/integrations/:path*",
    "/api/users/:path*",
    "/api/tenant/:path*",
    "/api/mfa/:path*",
  ],
};