Move admin area to root subdomain

middleware.ts

@@ -3,6 +3,13 @@ import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
 
 import { routing } from "./i18n/routing";
+import {
+  getRequestHostname,
+  isAdminHost,
+  isInternalAdminPath,
+  isLegacyAdminPath,
+  toInternalAdminPath,
+} from "./lib/admin-routing";
 
 const intlMiddleware = createMiddleware(routing);
 
@@ -41,12 +48,39 @@ function isRootBasicAuthValid(request: NextRequest): boolean {
 
 export default async function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
-  const isRootBaseRoute = pathname === "/root" || pathname.startsWith("/root/");
-  const isRootRoute = isRootBaseRoute;
+  const hostname = getRequestHostname(
+    request.headers.get("x-forwarded-host") ?? request.headers.get("host") ?? request.nextUrl.hostname,
+  );
+  const isAdminRequest = isAdminHost(hostname);
   const rootRobotsHeaders = {
     "X-Robots-Tag": "noindex, nofollow, noarchive, nosnippet, noimageindex",
   };
 
+  if (isInternalAdminPath(pathname) || isLegacyAdminPath(pathname)) {
+    return new NextResponse("Not Found", {
+      status: 404,
+    });
+  }
+
+  if (isAdminRequest) {
+    if (isRootBasicAuthConfigured() && !isRootBasicAuthValid(request)) {
+      return new NextResponse("Authentication required", {
+        status: 401,
+        headers: {
+          "WWW-Authenticate": 'Basic realm="Root Area", charset="UTF-8"',
+          ...rootRobotsHeaders,
+        },
+      });
+    }
+
+    const rewriteUrl = request.nextUrl.clone();
+    rewriteUrl.pathname = toInternalAdminPath(pathname);
+
+    const response = NextResponse.rewrite(rewriteUrl);
+    response.headers.set("X-Robots-Tag", rootRobotsHeaders["X-Robots-Tag"]);
+    return response;
+  }
+
   if (pathname === "/de" || pathname.startsWith("/de/")) {
     const redirectUrl = request.nextUrl.clone();
     const nextPath = pathname.slice(3) || "/";
@@ -54,22 +88,6 @@ export default async function middleware(request: NextRequest) {
     return NextResponse.redirect(redirectUrl, 308);
   }
 
-  if (isRootRoute && isRootBasicAuthConfigured() && !isRootBasicAuthValid(request)) {
-    return new NextResponse("Authentication required", {
-      status: 401,
-      headers: {
-        "WWW-Authenticate": 'Basic realm="Root Area", charset="UTF-8"',
-        ...rootRobotsHeaders,
-      },
-    });
-  }
-
-  if (isRootBaseRoute) {
-    const response = NextResponse.next();
-    response.headers.set("X-Robots-Tag", rootRobotsHeaders["X-Robots-Tag"]);
-    return response;
-  }
-
   return intlMiddleware(request);
 }