@bagelink/auth 1.15.531 → 1.15.535

package/dist/index.cjs

@@ -1600,6 +1600,13 @@ function authGuard() {
       return true;
     } catch (error) {
       console.error("[Auth Guard] Error:", error);
+      if (requiresAuth) {
+        const query = buildLoginQuery(to.fullPath, config);
+        return {
+          name: config.loginRoute,
+          query
+        };
+      }
       return true;
     }
   };

package/dist/index.mjs

@@ -1598,6 +1598,13 @@ function authGuard() {
       return true;
     } catch (error) {
       console.error("[Auth Guard] Error:", error);
+      if (requiresAuth) {
+        const query = buildLoginQuery(to.fullPath, config);
+        return {
+          name: config.loginRoute,
+          query
+        };
+      }
       return true;
     }
   };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bagelink/auth",
   "type": "module",
-  "version": "1.15.531",
+  "version": "1.15.535",
   "description": "Bagelink auth package",
   "author": {
     "name": "Bagel Studio",

package/src/router.test.ts

@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { RouteLocationNormalized } from 'vue-router'
+
+const authState = vi.hoisted(() => ({
+	user: { value: null as object | null },
+	ensureInitialAuth: vi.fn<() => Promise<boolean>>(),
+}))
+
+vi.mock('./useAuth', () => ({
+	useAuth: () => ({ user: authState.user }),
+	getRedirectConfig: () => ({
+		authMetaKey: 'auth',
+		noAuthRoutes: ['Login'],
+		authenticatedRedirect: '/',
+		loginRoute: 'Login',
+		queryKey: 'redirect',
+		fallback: '/',
+		autoRedirect: true,
+		preserveRedirect: true,
+	}),
+	ensureInitialAuth: authState.ensureInitialAuth,
+	resetInitialAuth: vi.fn(),
+}))
+
+import { authGuard } from './router'
+
+function route(overrides: Partial<RouteLocationNormalized> = {}): RouteLocationNormalized {
+	return {
+		fullPath: '/protected',
+		hash: '',
+		matched: [],
+		meta: {},
+		name: 'Protected',
+		params: {},
+		path: '/protected',
+		query: {},
+		redirectedFrom: undefined,
+		...overrides,
+	} as RouteLocationNormalized
+}
+
+describe('authGuard', () => {
+	beforeEach(() => {
+		authState.user.value = null
+		authState.ensureInitialAuth.mockReset()
+	})
+
+	it('redirects protected routes when auth bootstrap fails', async () => {
+		authState.ensureInitialAuth.mockRejectedValueOnce(new Error('auth unavailable'))
+
+		await expect(authGuard()(route({ meta: { auth: true } }), route())).resolves.toEqual({
+			name: 'Login',
+			query: { redirect: '/protected' },
+		})
+	})
+
+	it('allows public routes when auth bootstrap fails', async () => {
+		authState.ensureInitialAuth.mockRejectedValueOnce(new Error('auth unavailable'))
+
+		await expect(authGuard()(route(), route())).resolves.toBe(true)
+	})
+})

package/src/router.ts

@@ -73,7 +73,15 @@ export function authGuard() {
 			return true
 		} catch (error) {
 			console.error('[Auth Guard] Error:', error)
-			// On error, allow navigation but log the issue
+			// Never render a protected route when the session could not be
+			// established. Public routes remain available during auth outages.
+			if (requiresAuth) {
+				const query = buildLoginQuery(to.fullPath, config)
+				return {
+					name: config.loginRoute,
+					query,
+				}
+			}
 			return true
 		}
 	}