fix: login redirect, admin auth guard, JWT_SECRET env

src/middleware.ts

@@ -6,29 +6,14 @@ import type { NextRequest } from 'next/server';
 // In a production environment, you would want to verify the token
 export function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
+  const token = request.cookies.get('session')?.value;
   
-  // Protect admin routes
-  if (pathname.startsWith('/admin')) {
-    // Get session token from cookies
-    const token = request.cookies.get('session')?.value;
-    
-    // If no token, redirect to login
-    if (!token) {
-      return NextResponse.redirect(new URL('/login', request.url));
-    }
-    
-    // Note: In a real implementation, you would verify the token here
-    // For now, we're just checking that a token exists
-  }
+  // Protect admin routes - let page handle auth UI
+  // No redirect here; the admin page shows login prompt if not authenticated
   
-  // Redirect authenticated users from login page to home
-  if (pathname === '/login') {
-    const token = request.cookies.get('session')?.value;
-    if (token) {
-      // In a real implementation, you would verify the token and check role
-      // For now, we'll just redirect to home
-      return NextResponse.redirect(new URL('/', request.url));
-    }
+  // If logged in and trying to access login, redirect to admin
+  if (pathname === '/login' && token) {
+    return NextResponse.redirect(new URL('/admin', request.url));
   }
   
   return NextResponse.next();