auth-and-guards

Create a pathless _authenticated layout route with a beforeLoad function that throws redirect() to /login when context.auth.isAuthenticated is false. Any route file placed under src/routes/_authenticated/ is automatically protected.

Pass location.href as a redirect search param when throwing redirect() to /login, then validate it with validateSearch and sanitize it to a relative path. After successful login, navigate to that saved redirect target.

No. A beforeLoad guard only protects the route's UI; createServerFn produces an RPC endpoint reachable directly regardless of the route. Every server function touching user data needs authMiddleware or an in-handler auth check.

redirect() works by throwing, so a catch block intercepts it. Use the isRedirect helper to check caught errors and re-throw redirects, handling only genuine errors in the catch block.

Extend your auth state with hasRole, hasAnyRole, and hasPermission helpers, then check them in beforeLoad of nested pathless layout routes like _admin or _moderator. Failed checks throw redirect() to an unauthorized page.

Yes. In the _authenticated layout route component, read auth from Route.useRouteContext() and render a login form instead of Outlet when unauthenticated. The URL stays unchanged and protected content appears after login.