fix(manager): redirect unauth nav to login instead of 401

AddAuthBlocks installs JwtBearer as the default challenge scheme; the authorization middleware 401s unauthenticated nav requests before the Blazor router runs. Tokens live in localStorage and are only readable via JS interop after the SignalR circuit is live. - Program.cs: MapRazorComponents .AllowAnonymous() so nav reaches the Blazor router; API surfaces (MapAuthBlocks, MapControllers) still enforce JWT. Fix middleware order to UseAuthentication -> UseAntiforgery -> UseAuthorization per Blazor Web App template. - App.razor: InteractiveServerRenderMode(prerender:false) on Routes and HeadOutlet so AuthorizeRouteView evaluates after JS interop is ready; extract to static field (was two inline allocations per render cycle). - CmsLayout/Pages: drop conflicting per-component @rendermode directives (parent now owns the render mode). - Routes.razor: break authenticated-but-wrong-role redirect loop; split NotAuthorized into unauthenticated -> RedirectToLogin and authenticated-wrong-role -> RedirectToAccessDenied (new component). - Pages/Index.razor: deleted — NavigateTo('/cms') was unreachable for unauthenticated users and racey for authorized ones.
2026-05-24 18:29:07 -04:00
parent e6dc15e451
commit 95772c655e
7 changed files with 35 additions and 19 deletions
@@ -12,12 +12,16 @@
    <link rel="stylesheet" href="@Assets["_content/DeepDrftShared.Client/styles/deepdrft-tokens.css"]" />
    <ImportMap />
    <link rel="icon" type="image/ico" href="deepdrft-logo.ico" />
-    <HeadOutlet />
+    <HeadOutlet @rendermode="ServerMode" />
 </head>

 <body>
-<Routes />
+<Routes @rendermode="ServerMode" />
 <script src="_framework/blazor.web.js"></script>
 <script src=@Assets["_content/MudBlazor/MudBlazor.min.js"]></script>
 </body>
 </html>
+
+@code {
+    private static readonly IComponentRenderMode ServerMode = new InteractiveServerRenderMode(prerender: false);
+}