From 7d01ae669a4226bc641d899720113760a5f604d9 Mon Sep 17 00:00:00 2001
From: "alexei.dolgolyov" <dolgolyov.alexei@gmail.com>
Date: Fri, 20 Mar 2026 00:15:50 +0300
Subject: [PATCH] fix: add auth guard to root layout with setup/login redirects

Layout now checks auth on mount and redirects:
- No users exist -> /setup
- Not authenticated -> /login
- Shows loading state while checking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 frontend/src/routes/+layout.svelte | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index b3c305b..2c03e48 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -1,10 +1,31 @@
-<script>
+<script lang="ts">
 	import '../app.css';
 	import { initTheme } from '$lib/theme.svelte.ts';
-
+	import { checkAuth, isLoading, isAuthenticated, getNeedsSetup } from '$lib/auth.svelte.ts';
+	import { onMount } from 'svelte';
 	let { children } = $props();
+	let mounted = $state(false);
 
-	initTheme();
+	onMount(() => {
+		initTheme();
+		checkAuth().then(() => {
+			mounted = true;
+			const path = window.location.pathname;
+			const publicPaths = ['/login', '/setup'];
+
+			if (getNeedsSetup() && path !== '/setup') {
+				window.location.href = '/setup';
+			} else if (!getNeedsSetup() && !isAuthenticated() && !publicPaths.includes(path)) {
+				window.location.href = '/login';
+			}
+		});
+	});
 </script>
 
-{@render children()}
+{#if !mounted || isLoading()}
+	<div class="min-h-screen flex items-center justify-center">
+		<p class="text-muted-foreground">Loading...</p>
+	</div>
+{:else}
+	{@render children()}
+{/if}