CDNManager/apps/web/src/routes/__root.tsx

import { createRootRouteWithContext, Outlet, redirect } from '@tanstack/react-router'
import type { QueryClient } from '@tanstack/react-query'
import {
  ensureAuthConfig,
  getClaims,
  getToken,
  redirectToPortalLogin,
} from '@/lib/auth'

export interface RouterContext {
  queryClient: QueryClient
}

export const Route = createRootRouteWithContext<RouterContext>()({
  component: () => <Outlet />,
  beforeLoad: async ({ location }) => {
    const isLogin = location.pathname === '/login'
    const isCallback = location.pathname === '/auth/callback'
    const isAccessDenied = location.pathname === '/access-denied'
    if (isCallback || isAccessDenied) return

    const cfg = await ensureAuthConfig()
    const token = getToken()
    const claims = getClaims()

    if (cfg.required) {
      if (isLogin) {
        const ok = redirectToPortalLogin(
          `${window.location.origin}/auth/callback`,
        )
        if (!ok) {
          throw redirect({
            to: '/auth/callback',
            search: { error: 'sso_loop' },
          })
        }
        await new Promise(() => {})
        return
      }
      if (!token || !claims) {
        const ok = redirectToPortalLogin(
          `${window.location.origin}/auth/callback`,
        )
        if (!ok) {
          throw redirect({
            to: '/auth/callback',
            search: { error: 'sso_loop' },
          })
        }
        await new Promise(() => {})
        return
      }
      return
    }

    // Local auth mode (AUTH_REQUIRED=false)
    if (!token && !isLogin) {
      throw redirect({ to: '/login' })
    }
    if (token && isLogin) {
      throw redirect({ to: '/' })
    }
  },
})