AuthGuard

A functional route guard that checks authentication, loads the principal, and redirects to change-password when a credentials session's password has expired.

AuthGuard() returns a CanActivateFn that protects a route: it checks the user is authenticated, ensures PrincipalStore is loaded, and — in credentials mode — redirects to the change-password view when the session's password has expired.

Minimal example

Guarding a protected route

app.routes.ts

import { AuthGuard, AuthPageComponent, ErrorComponent } from "@sinequa/atomic-angular";
import type { Routes } from "@angular/router";

export const routes: Routes = [
  { path: "login", component: AuthPageComponent }, // credentials / changepassword / forgotpassword
  { path: "logout", component: AuthPageComponent },
  { path: "error", component: ErrorComponent },
  { path: "search", component: null as never, canActivate: [AuthGuard()] },
];

How it works

Two details worth knowing:

The guard lets /login and /logout through unconditionally — guarding the login form against "not logged in" would redirect it to itself, and guarding /logout would send a user who just signed out back to the form they just left.
initialize() runs whenever the store's state is not "loaded" — not only when it is "initial". That covers an initialization already in flight elsewhere ("loading", awaited rather than assumed absent — initialize() itself de-duplicates concurrent calls into the same fetch) and a previous failed attempt ("error", retried instead of permanently redirecting to login).
SSO mode (authMode.kind === "sso"): the browser/proxy carries the auth, so an unauthenticated state is let through — the session is established out of band.
Not authenticated (non-SSO): redirect to loginPath with the original URL as returnUrl.
Credentials mode, expired password: when the partition is editable and the password is expired, the guard redirects to /login?mode=changepassword&alert=passwordExpired&username=….