Function RequireAuth

packages/ui/src/routes/RequireAuth.jsx:30–88

({ permission, display, children })

}

export const RequireAuth = ({ permission, display, children }) => {
    const location = useLocation()
    const { isCloud, isOpenSource, isEnterpriseLicensed, loading } = useConfig()
    const { hasPermission } = useAuth()
    const isGlobal = useSelector((state) => state.auth.isGlobal)
    const currentUser = useSelector((state) => state.auth.user)
    const features = useSelector((state) => state.auth.features)
    const permissions = useSelector((state) => state.auth.permissions)

    // Step 0: Wait for config to load
    if (loading) {
        return null
    }

    // Step 1: Authentication Check
    // Redirect to login if user is not authenticated
    if (!currentUser) {
        return <Navigate to='/login' replace state={{ path: location.pathname }} />
    }

    // Step 2: Deployment Type Specific Logic
    // Open Source: Only show features without display property
    if (isOpenSource) {
        return !display ? children : <Navigate to='/unauthorized' replace />
    }

    // Cloud & Enterprise: Check both permissions and feature flags
    if (isCloud || isEnterpriseLicensed) {
        // Routes with display property - check feature flags
        if (display) {
            // Check if user has any permissions
            if (permissions.length === 0) {
                return <Navigate to='/unauthorized' replace state={{ path: location.pathname }} />
            }

            // Organization admins bypass permission checks
            if (isGlobal) {
                return checkFeatureFlag(features, display, children)
            }

            // Check user permissions and feature flags
            if (!permission || hasPermission(permission)) {
                return checkFeatureFlag(features, display, children)
            }

            return <Navigate to='/unauthorized' replace />
        }

        // Standard routes: check permissions (global admins bypass)
        if (permission && !hasPermission(permission) && !isGlobal) {
            return <Navigate to='/unauthorized' replace />
        }

        return children
    }

    // Fallback: If none of the platform types match, deny access
    return <Navigate to='/unauthorized' replace />