fix(auth-routing): require explicit preview opt-in, add unauthorized route handling, and normalize error-page redirects

Author: Diogo Ferraz

src/app/app.component.ts

@@ -100,7 +100,8 @@ export class AppComponent {
     return currentUrl === '/' ||
       currentUrl.startsWith('/login') ||
       currentUrl.startsWith('/callback') ||
-      currentUrl.startsWith('/not-found');
+      currentUrl.startsWith('/not-found') ||
+      currentUrl.startsWith('/unauthorized');
   }
 
   ngOnDestroy() {

src/app/app.routes.ts

@@ -12,6 +12,7 @@ import { authGuard } from './core/auth/guards/auth.guard';
 import { AuthCallbackComponent } from './features/login/components/auth-callback/auth-callback.component';
 import { LandingPageComponent } from './features/landing/components/landing-page/landing-page.component';
 import { NotFoundComponent } from './features/errors/components/not-found/not-found.component';
+import { UnauthorizedComponent } from './features/errors/components/unauthorized/unauthorized.component';
 import { SearchFiltersComponent } from './features/search/components/search-filters/search-filters.component';
 import { ProjectDocsComponent } from './features/docs/components/project-docs/project-docs.component';
 import { TaskCalendarComponent } from './features/calendar/components/task-calendar/task-calendar.component';
@@ -45,6 +46,8 @@ export const routes: Routes = [
   { path: 'tasks/my-tasks', component: UserTaskItemsComponent, canActivate: [authGuard] },
   { path: 'login', component: HomeLoginComponent },
   { path: 'callback', component: AuthCallbackComponent },
+  { path: 'notfound', redirectTo: 'not-found' },
   { path: 'not-found', component: NotFoundComponent },
-  { path: '**', component: NotFoundComponent }
+  { path: 'unauthorized', component: UnauthorizedComponent },
+  { path: '**', redirectTo: 'not-found' }
 ];

src/app/core/auth/guards/admin-role.guard.spec.ts

@@ -25,7 +25,7 @@ describe('adminRoleGuard', () => {
     expect(routerMock.createUrlTree).not.toHaveBeenCalled();
   });
 
-  it('redirects non-admin users to dashboard', () => {
+  it('redirects non-admin users to unauthorized', () => {
     const redirectTree = {} as never;
     const authServiceMock = {
       hasRole: () => false
@@ -44,6 +44,6 @@ describe('adminRoleGuard', () => {
 
     const canActivate = TestBed.runInInjectionContext(() => adminRoleGuard({} as never, {} as never));
     expect(canActivate).toBe(redirectTree);
-    expect(routerMock.createUrlTree).toHaveBeenCalledWith(['/dashboard']);
+    expect(routerMock.createUrlTree).toHaveBeenCalledWith(['/unauthorized']);
   });
 });

src/app/core/auth/guards/admin-role.guard.ts

@@ -10,5 +10,5 @@ export const adminRoleGuard: CanActivateFn = () => {
     return true;
   }
 
-  return router.createUrlTree(['/dashboard']);
+  return router.createUrlTree(['/unauthorized']);
 };

src/app/core/auth/guards/auth.guard.spec.ts

@@ -1,4 +1,5 @@
 import { TestBed } from '@angular/core/testing';
+import { Router } from '@angular/router';
 import { AuthService } from '../services/auth.service';
 import { authGuard } from './auth.guard';
 
@@ -7,50 +8,69 @@ describe('authGuard', () => {
     const authServiceMock = {
       isAuthenticated: () => true,
       authSession: () => null,
-      canStartDebugSession: () => false,
-      startLoginRedirect: jasmine.createSpy('startLoginRedirect').and.resolveTo()
+      canStartDebugSession: () => false
+    };
+
+    const routerMock = {
+      createUrlTree: jasmine.createSpy('createUrlTree')
     };
 
     TestBed.configureTestingModule({
-      providers: [{ provide: AuthService, useValue: authServiceMock }]
+      providers: [
+        { provide: AuthService, useValue: authServiceMock },
+        { provide: Router, useValue: routerMock }
+      ]
     });
 
     const canActivate = TestBed.runInInjectionContext(() => authGuard({} as never, {} as never));
     expect(canActivate).toBeTrue();
-    expect(authServiceMock.startLoginRedirect).not.toHaveBeenCalled();
+    expect(routerMock.createUrlTree).not.toHaveBeenCalled();
   });
 
-  it('starts login redirect when user is not authenticated', () => {
+  it('redirects to unauthorized when user is not authenticated', () => {
+    const redirectTree = {} as never;
     const authServiceMock = {
       isAuthenticated: () => false,
       authSession: () => null,
-      canStartDebugSession: () => false,
-      startLoginRedirect: jasmine.createSpy('startLoginRedirect').and.resolveTo()
+      canStartDebugSession: () => false
+    };
+
+    const routerMock = {
+      createUrlTree: jasmine.createSpy('createUrlTree').and.returnValue(redirectTree)
     };
 
     TestBed.configureTestingModule({
-      providers: [{ provide: AuthService, useValue: authServiceMock }]
+      providers: [
+        { provide: AuthService, useValue: authServiceMock },
+        { provide: Router, useValue: routerMock }
+      ]
     });
 
     const canActivate = TestBed.runInInjectionContext(() => authGuard({} as never, {} as never));
-    expect(canActivate).toBeFalse();
-    expect(authServiceMock.startLoginRedirect).toHaveBeenCalled();
+    expect(canActivate).toBe(redirectTree);
+    expect(routerMock.createUrlTree).toHaveBeenCalledWith(['/unauthorized']);
   });
 
   it('allows navigation when debug session is active in preview mode', () => {
     const authServiceMock = {
       isAuthenticated: () => false,
       authSession: () => ({ isDebugSession: true }),
-      canStartDebugSession: () => true,
-      startLoginRedirect: jasmine.createSpy('startLoginRedirect').and.resolveTo()
+      canStartDebugSession: () => true
+    };
+
+    const routerMock = {
+      createUrlTree: jasmine.createSpy('createUrlTree')
     };
 
     TestBed.configureTestingModule({
-      providers: [{ provide: AuthService, useValue: authServiceMock }]
+      providers: [
+        { provide: AuthService, useValue: authServiceMock },
+        { provide: Router, useValue: routerMock }
+      ]
     });
 
     const canActivate = TestBed.runInInjectionContext(() => authGuard({} as never, {} as never));
     expect(canActivate).toBeTrue();
-    expect(authServiceMock.startLoginRedirect).not.toHaveBeenCalled();
+    expect(routerMock.createUrlTree).not.toHaveBeenCalled();
   });
 });

src/app/core/auth/guards/auth.guard.ts

@@ -1,9 +1,10 @@
-import { CanActivateFn } from '@angular/router';
+import { CanActivateFn, Router } from '@angular/router';
 import { inject } from '@angular/core';
 import { AuthService } from '../services/auth.service';
 
 export const authGuard: CanActivateFn = () => {
   const authService = inject(AuthService);
+  const router = inject(Router);
 
   const debugSession = authService.authSession();
   if (debugSession?.isDebugSession && authService.canStartDebugSession()) {
@@ -14,6 +15,5 @@ export const authGuard: CanActivateFn = () => {
     return true;
   }
 
-  void authService.startLoginRedirect();
-  return false;
+  return router.createUrlTree(['/unauthorized']);
 };

src/app/core/auth/guards/manager-or-admin.guard.ts

@@ -10,6 +10,5 @@ export const managerOrAdminGuard: CanActivateFn = () => {
     return true;
   }
 
-  return router.createUrlTree(['/dashboard']);
+  return router.createUrlTree(['/unauthorized']);
 };
-

src/app/features/activity/components/activity-log/activity-log.component.ts

@@ -187,11 +187,7 @@ export class ActivityLogComponent implements OnInit, OnDestroy {
   }
 
   private shouldUsePreviewMode(): boolean {
-    if (!this.appEnvironment.production) {
-      return true;
-    }
-
-    return this.authService.authSession()?.isDebugSession === true;
+    return this.authService.authSession()?.isDebugSession === true && this.authService.canStartDebugSession();
   }
 
   private loadPreviewData(detail: string): void {
@@ -305,4 +301,3 @@ export class ActivityLogComponent implements OnInit, OnDestroy {
     }
   }
 }
-

src/app/features/activity/components/my-activity/my-activity.component.ts

@@ -217,11 +217,7 @@ export class MyActivityComponent implements OnInit, OnDestroy {
   }
 
   private shouldUsePreviewMode(): boolean {
-    if (!this.appEnvironment.production) {
-      return true;
-    }
-
-    return this.authService.authSession()?.isDebugSession === true;
+    return this.authService.authSession()?.isDebugSession === true && this.authService.canStartDebugSession();
   }
 
   private loadPreviewActivity(detail: string): void {
@@ -305,4 +301,3 @@ export class MyActivityComponent implements OnInit, OnDestroy {
     return value.replace(/<[^>]*>/g, ' ');
   }
 }
-

src/app/features/admin/components/admin-dashboard/admin-dashboard.component.ts

@@ -275,11 +275,7 @@ export class AdminDashboardComponent implements OnInit {
   }
 
   private shouldUsePreviewMode(): boolean {
-    if (!this.appEnvironment.production) {
-      return true;
-    }
-
-    return this.authService.authSession()?.isDebugSession === true;
+    return this.authService.authSession()?.isDebugSession === true && this.authService.canStartDebugSession();
   }
 
   private loadPreviewUsers(detail: string): void {