routes fix

extensive loging added

apps/admin/src/middleware.ts

@@ -1,30 +1,43 @@
 import { clerkMiddleware, createRouteMatcher } from "@clerk/nextjs/server";
 
-// Define routes that should be publicly accessible
+// Define routes that should be publicly accessible (no auth required)
 const isPublicRoute = createRouteMatcher([
   "/sign-in(.*)",
   "/sign-up(.*)",
   "/api/webhooks(.*)",
-  "/api/attendance(.*)",
+  "/api/health(.*)",
 ]);
 
-// Define routes that require authentication
-const isProtectedRoute = createRouteMatcher([
-  "/",
-  "/users(.*)",
-  "/analytics(.*)",
-  "/profile(.*)",
-  "/api/users(.*)",
-  "/api/profile(.*)",
-  "/api/payments(.*)",
-  "/api/notifications(.*)",
-]);
+// Define API routes that need auth but should be handled in the route itself
+// This prevents auth.protect() from blocking before the route handler runs
+const isApiRoute = createRouteMatcher(["/api/(.*)"]);
 
 export default clerkMiddleware(async (auth, req) => {
-  // Protect all routes except public ones
-  if (!isPublicRoute(req)) {
-    await auth.protect();
+  // Log for debugging
+  const authHeader = req.headers.get("authorization");
+  if (authHeader) {
+    console.log(
+      "[Middleware] Authorization header present:",
+      authHeader.substring(0, 20) + "...",
+    );
   }
+
+  // Don't protect public routes
+  if (isPublicRoute(req)) {
+    console.log("[Middleware] Public route, skipping auth");
+    return;
+  }
+
+  // For API routes, let the route handler check auth
+  // This allows API routes to handle both web sessions and mobile Bearer tokens
+  if (isApiRoute(req)) {
+    console.log("[Middleware] API route, auth will be checked in handler");
+    return;
+  }
+
+  // For all other routes (web pages), enforce authentication
+  console.log("[Middleware] Protected route, requiring auth");
+  await auth.protect();
 });
 
 export const config = {