fix the errors in dashboard

apps/dashboard/src/middleware.ts

@@ -1,18 +1,41 @@
 import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
 
+const PUBLIC_DASHBOARD_PREFIXES = ['/dashboard/sign-in', '/dashboard/forgot-password']
+const MARKETPLACE_URL = process.env.NEXT_PUBLIC_MARKETPLACE_URL ?? 'http://localhost:3000'
+
+function isInternalHost(host: string | null): boolean {
+  if (!host) return false
+  const hostname = host.split(':')[0]?.toLowerCase()
+  return ['host.docker.internal', 'dashboard', 'admin', 'api', 'marketplace'].includes(hostname)
+}
+
 function isProtectedRoute(req: NextRequest) {
-  return req.nextUrl.pathname === '/dashboard' || req.nextUrl.pathname.startsWith('/dashboard/')
+  const { pathname } = req.nextUrl
+  if (PUBLIC_DASHBOARD_PREFIXES.some((p) => pathname === p || pathname.startsWith(p + '/'))) return false
+  return pathname === '/dashboard' || pathname.startsWith('/dashboard/')
 }
 
 function localJwtMiddleware(req: NextRequest): NextResponse {
   if (!isProtectedRoute(req)) return NextResponse.next()
 
-  // Check for employee_token cookie (set on login) OR allow if coming from sign-in
   const token = req.cookies.get('employee_token')?.value
   if (!token) {
+    const forwardedHost = req.headers.get('x-forwarded-host')
+    const forwardedProto = req.headers.get('x-forwarded-proto')
+    const marketplaceOrigin = new URL(MARKETPLACE_URL)
+
     const signInUrl = req.nextUrl.clone()
-    signInUrl.pathname = '/sign-in'
+    if (forwardedHost && !isInternalHost(forwardedHost)) {
+      signInUrl.host = forwardedHost
+      signInUrl.protocol = (forwardedProto ?? 'http') + ':'
+    } else if (isInternalHost(signInUrl.host)) {
+      signInUrl.host = marketplaceOrigin.host
+      signInUrl.protocol = marketplaceOrigin.protocol
+    }
+
+    const isMarketplaceHost = signInUrl.host === marketplaceOrigin.host
+    signInUrl.pathname = isMarketplaceHost ? '/sign-in' : '/dashboard/sign-in'
     signInUrl.searchParams.set('redirect', req.nextUrl.pathname)
     return NextResponse.redirect(signInUrl)
   }