router-core/auth-and-guards

Guard TanStack Router routes by adding a beforeLoad check to block unauthenticated users. This intercepts navigation to enforce auth decisions before route loading, ensuring protected content is never rendered until the auth provider resolves the session state.

isRedirect handling catches redirect errors thrown during beforeLoad checks, allowing safe navigation to login pages. This mechanism prevents unhandled rejection errors when routing unauthenticated users away from protected admin dashboards.

Yes, you can implement RBAC with roles and permissions across nested routes. The beforeLoad guard evaluates user roles from the router context to restrict access to specific admin dashboards and user areas based on assigned permissions.

Yes, the auth guard integrates with Auth0, Clerk, and Supabase. It connects the auth provider to the router context, sharing the authentication state consistently across loaders and components throughout the client-side application.

The best way to share auth state is using the router context. Storing the auth provider session in the router context exposes consistent authentication data to both beforeLoad guards and nested route components.