Systeme de Dashboards

// Role-based route protection
const ROUTE_PERMISSIONS = {
  '/dashboard': ['PARTICULIER', 'ADMIN'],  // 40+ pages
  '/pro':       ['PROFESSIONNEL', 'ADMIN'], // 14 pages
  '/admin':     ['ADMIN'],                  // 15 pages
};

// Middleware flow:
// 1. Extract JWT from auth-token cookie
// 2. Verify token signature & expiration
// 3. Check user role against route permissions
// 4. Rate limiting: 100 requests/min per IP
// 5. Allow or redirect to /auth/signin

export async function verifyRouteAccess(
  pathname: string,
  token: string
): Promise<{ allowed: boolean; redirect?: string }> {
  const decoded = await verifyJWT(token);
  if (!decoded) return { allowed: false, redirect: '/auth/signin' };

  const requiredRoles = getRequiredRoles(pathname);
  if (!requiredRoles.includes(decoded.role)) {
    return { allowed: false, redirect: getRoleRedirect(decoded.role) };
  }

  return { allowed: true };
}