Recipes
Authentication, authorization, and unsaved changes
Choose Redirect or Guard from the required outcome and handle intentional denial without recursive navigation.
Authentication, authorization, and unsaved changes
Send a signed-out user to Login
Return LoginDestination from a Redirect. The requested protected Page is never committed.
Reject a user without permission
Return NavigationGuardDenied(reason: PermissionReason.missingRole) from an enter Guard. The caller receives NavigationRejected; a presentation boundary decides how to explain it.
Protect an editor from accidental leave
Evaluate context.phase == NavigationGuardPhase.leave. Return a typed denial reason while a draft exists. After the user confirms discard, update editor state and retry the original application action from outside the Guard.
React to sign-out
Adapt authentication state with ListenableNavigationPolicyRefresh. The Session reconciles the current Destination. Do not make every visible feature listen for sign-out and issue its own replacement.
Report policy failures
Intentional denial is not an exception. An exception thrown by a policy is infrastructure failure and should reach NavigationFailureSink and diagnostic events.