sequenceDiagram
    participant User
    participant Middleware
    participant NextResponse
    participant SessionCookie
    participant Logger

    User->>Middleware: "Incoming Request"
    Middleware->>SessionCookie: "getSessionCookie(request)"
    SessionCookie-->>Middleware: "sessionCookie"
    Middleware->>Middleware: "hasActiveSession = !!sessionCookie"

    alt Root Path (/ or /homepage)
        Middleware->>Middleware: "handleRootPathRedirects()"
        alt hasActiveSession && pathname === '/'
            Middleware->>NextResponse: "redirect('/workspace')"
            NextResponse-->>User: "Redirect to workspace"
        else pathname === '/homepage'
            Middleware->>NextResponse: "rewrite('/')"
            NextResponse-->>User: "Rewrite to root"
        end
    else Login/Signup Path
        alt hasActiveSession
            Middleware->>NextResponse: "redirect('/workspace')"
            NextResponse-->>User: "Redirect to workspace"
        else
            Middleware->>NextResponse: "next()"
            NextResponse-->>User: "Allow access"
        end
    else Chat Path (/chat/*)
        Middleware->>NextResponse: "next()"
        NextResponse-->>User: "Allow access"
    else Workspace Path
        alt !hasActiveSession
            Middleware->>NextResponse: "redirect('/login')"
            NextResponse-->>User: "Redirect to login"
        else
            Middleware->>NextResponse: "next()"
            NextResponse-->>User: "Allow access"
        end
    else Invitation Path
        Middleware->>Middleware: "handleInvitationRedirects()"
        alt !hasActiveSession && needs redirect
            Middleware->>NextResponse: "redirect('/login?callbackUrl=...')"
            NextResponse-->>User: "Redirect to login with callback"
        else
            Middleware->>NextResponse: "next()"
            NextResponse-->>User: "Allow access"
        end
    else API Workspace Invitation
        Middleware->>Middleware: "handleWorkspaceInvitationAPI()"
        alt !hasActiveSession && accept endpoint
            Middleware->>NextResponse: "redirect('/invite/{token}')"
            NextResponse-->>User: "Redirect to invite page"
        else
            Middleware->>NextResponse: "next()"
            NextResponse-->>User: "Allow access"
        end
    else Security Check
        Middleware->>Middleware: "handleSecurityFiltering()"
        alt Suspicious User-Agent && !webhook
            Middleware->>Logger: "warn('Blocked suspicious request')"
            Middleware->>NextResponse: "403 Forbidden"
            NextResponse-->>User: "403 Forbidden"
        else
            Middleware->>NextResponse: "next() with headers"
            NextResponse-->>User: "Allow with security headers"
        end
    end