From 24b1823a5d74089020f7bd3f4d1e6bc9dc0645d2 Mon Sep 17 00:00:00 2001
From: Stephen Adamson <popertots@gmail.com>
Date: Thu, 4 Jun 2026 20:04:54 +0100
Subject: [PATCH] fix(routes): add pre-hydration auth redirects to all
 protected pages

Replaced slow $effect-based auth checks with synchronous IIFE scripts in <svelte:head> that run during HTML parsing, before Svelte hydration. Covers: /today, /admin, /admin/schedule, /manage, /notifications (admin-only), and /account (auth-required). All redirect via window.location.replace() with no page flash.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
---
 frontend/src/routes/account/+page.svelte        | 10 ++++++++++
 frontend/src/routes/admin/+page.svelte          | 14 ++++++++++++++
 frontend/src/routes/admin/schedule/+page.svelte | 14 ++++++++++++++
 frontend/src/routes/manage/+page.svelte         | 14 ++++++++++++++
 frontend/src/routes/notifications/+page.svelte  | 14 ++++++++++++++
 frontend/src/routes/today/+page.svelte          | 14 ++++++++++++++
 6 files changed, 80 insertions(+)

diff --git a/frontend/src/routes/account/+page.svelte b/frontend/src/routes/account/+page.svelte
index 7ad6d92..0827b08 100644
--- a/frontend/src/routes/account/+page.svelte
+++ b/frontend/src/routes/account/+page.svelte
@@ -766,6 +766,16 @@
 </script>
 
 <svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
 	<style>
 		:root {
 			--bgColorMenu: #1d1d27;
diff --git a/frontend/src/routes/admin/+page.svelte b/frontend/src/routes/admin/+page.svelte
index 040774d..e137e5c 100644
--- a/frontend/src/routes/admin/+page.svelte
+++ b/frontend/src/routes/admin/+page.svelte
@@ -66,6 +66,20 @@
 	}
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); return; }
+				if (payload.role !== 'admin') { window.location.replace('/'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
+</svelte:head>
+
 {#if pageState === 'loading'}
 	<!-- Full page skeleton loading -->
 	<div class="mx-auto max-w-6xl space-y-6 p-6">
diff --git a/frontend/src/routes/admin/schedule/+page.svelte b/frontend/src/routes/admin/schedule/+page.svelte
index 11c1ff4..e6986ae 100644
--- a/frontend/src/routes/admin/schedule/+page.svelte
+++ b/frontend/src/routes/admin/schedule/+page.svelte
@@ -372,6 +372,20 @@
 	});
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); return; }
+				if (payload.role !== 'admin') { window.location.replace('/'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
+</svelte:head>
+
 {#if pageState === 'loading'}
 	<div class="mx-auto max-w-7xl space-y-6 p-4 md:p-6">
 		<Skeleton class="h-8 w-64" />
diff --git a/frontend/src/routes/manage/+page.svelte b/frontend/src/routes/manage/+page.svelte
index 0326e40..c891ca4 100644
--- a/frontend/src/routes/manage/+page.svelte
+++ b/frontend/src/routes/manage/+page.svelte
@@ -134,6 +134,20 @@
 	});
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); return; }
+				if (payload.role !== 'admin') { window.location.replace('/'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
+</svelte:head>
+
 {#if pageState === 'loading'}
 	<!-- Full page skeleton loading -->
 	<div class="mx-auto max-w-6xl space-y-6 p-6">
diff --git a/frontend/src/routes/notifications/+page.svelte b/frontend/src/routes/notifications/+page.svelte
index 6f1c5d0..4c44c7c 100644
--- a/frontend/src/routes/notifications/+page.svelte
+++ b/frontend/src/routes/notifications/+page.svelte
@@ -340,6 +340,20 @@
 	});
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); return; }
+				if (payload.role !== 'admin') { window.location.replace('/'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
+</svelte:head>
+
 {#if pageState === 'loading'}
 	<div class="mx-auto max-w-3xl space-y-4 p-6 pt-24">
 		<Skeleton class="h-8 w-48" />
diff --git a/frontend/src/routes/today/+page.svelte b/frontend/src/routes/today/+page.svelte
index fc6ef18..f62f156 100644
--- a/frontend/src/routes/today/+page.svelte
+++ b/frontend/src/routes/today/+page.svelte
@@ -77,6 +77,20 @@
 	});
 </script>
 
+<svelte:head>
+	<script>
+		(function() {
+			try {
+				var token = localStorage.getItem('authToken');
+				if (!token) { window.location.replace('/login'); return; }
+				var payload = JSON.parse(atob(token.split('.')[1]));
+				if (payload.exp * 1000 <= Date.now()) { window.location.replace('/login'); return; }
+				if (payload.role !== 'admin') { window.location.replace('/'); }
+			} catch(e) { window.location.replace('/login'); }
+		})();
+	</script>
+</svelte:head>
+
 {#if pageState === 'loading'}
 	<div class="mx-auto max-w-7xl space-y-6 p-4 md:p-6">
 		<!-- Header Skeleton -->