Enhance authentication handling with LifecycleGuard improvements

src/components/lifecycle-guard.tsx

@@ -53,6 +53,14 @@ export function LifecycleGuard({ children }: LifecycleGuardProps) {
             return;
         }
 
+        // Guard: If loaded and not authenticated, always redirect to sign-in
+        if (!lifecycleState.isAuthenticated) {
+            const returnUrl = encodeURIComponent(pathname);
+            redirectingRef.current = true;
+            router.push(`/sign-in?returnUrl=${returnUrl}`);
+            return;
+        }
+
         // 1. Force Redirect (Server Authority)
         // If server explicitly says "Go here" AND we aren't already there.
         // EXCEPTION: Allow access to any path in allowedPaths even if redirectTo is set.

src/features/auth/api/use-account-lifecycle.ts

@@ -91,14 +91,22 @@ export const useGetAccountLifecycle = () => {
             const response = await client.api.auth.lifecycle.$get();
 
             if (!response.ok) {
-                // If unauthorized, return unauthenticated state
+                // If unauthorized/session invalid, redirect to sign-in
                 return {
                     data: {
                         ...INITIAL_LIFECYCLE_STATE,
                         isLoaded: true,
                         isLoading: false,
                     },
-                    lifecycle: INITIAL_ROUTING,
+                    lifecycle: {
+                        state: "UNAUTHENTICATED",
+                        redirectTo: "/sign-in",
+                        allowedPaths: [],
+                        blockedPaths: ["*"],
+                        isTrialExpired: false,
+                        trialCreditGranted: false,
+                        trialCreditExpiresAt: null,
+                    },
                 };
             }