modified proxy to use jwt_secret

proxy.ts

@@ -1,25 +1,64 @@
 import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
+import { jwtVerify } from "jose";
 
-export function proxy(request: NextRequest) {
+if (!process.env.JWT_SECRET) {
+  console.error("coloca el JWT_SECRET en el .env")
+}
+
+const secret = new TextEncoder().encode(process.env.JWT_SECRET);
+
+export async function proxy(request: NextRequest) {
   const token = request.cookies.get("token")?.value;
   const pathname = request.nextUrl.pathname;
 
+  if (!token && pathname != "/") {
+    return NextResponse.redirect(new URL("/", request.url));
+  }
+
   if (pathname === "/" && token) {
     return NextResponse.redirect(new URL("/Impresiones", request.url));
   }
 
-  if (!token && pathname != "/") {
-    console.log("No hay token, redirigiendo a login");
-    return NextResponse.redirect(new URL("/", request.url));
+  if (token) {
+    try {
+      const { payload } = await jwtVerify(token, secret);
+
+      const role = payload.role as number;
+
+      const onlyImpresiones = ["/Impresiones"];
+
+      const limitedRoutes = [
+        "/Inscripcion",
+        "/Alta",
+        "/AgregarTiempo",
+        "/Impresiones",
+        "/AsignacionMesas",
+        "/AsignacionEquipo",
+        "/Monitor",
+      ];
+
+      if (role === 5 && !onlyImpresiones.includes(pathname)) {
+        return NextResponse.redirect(new URL("/Impresiones", request.url));
+      }
+
+      if ((role === 2 || role === 3) && !limitedRoutes.includes(pathname)) {
+        return NextResponse.redirect(new URL("/Impresiones", request.url));
+      }
+
+    } catch (error) {
+      if (pathname != "/") {
+        return NextResponse.redirect(new URL("/", request.url));
+      }
+    }
   }
 
   return NextResponse.next();
 }
 
 export const config = {
-  matcher: [   
-    "/", 
+  matcher: [
+    "/",
     "/Reportes",
     "/Monitor",
     "/QuitarSancion",
@@ -37,5 +76,4 @@ export const config = {
     "/AgregarTiempo",
     "/ActivosMantenimiento",
   ],
-};
-//IO
+};