Proxy-Based Dynamic Branch Evaluation for Reactive Navigation Guards in Next.js App Router

export function createPermissionGuard(userRoles) {
  return new Proxy({}, {
    get(target, prop) {
      if (typeof prop !== 'string') return false;
      const requiredRole = prop.toLowerCase().replace(/^canaccess/, '');
      return userRoles.includes(requiredRole);
    }
  });
}
 
export async function middleware(req) {
  const roles = req.headers.get('x-user-roles')?.split(',') || [];
  const guard = createPermissionGuard(roles);
  
  if (!guard.canAccessAdmin && req.nextUrl.pathname.startsWith('/admin')) {
    return NextResponse.redirect(new URL('/unauthorized', req.url));
  }
  return NextResponse.next();
}