Middleware

Introduction#

Magic Starter ships two route guards: EnsureAuthenticated (blocks a signed-out visitor from a protected route) and RedirectIfAuthenticated (blocks a signed-in visitor from a guest-only page, such as the login form). Both extend MagicMiddleware and override redirectTarget, so the redirect resolves inside the router's redirect callback before any page builds; the destination view mounts exactly once instead of building the gated page and then remounting.

Registering the Aliases#

Register them once in your app's Kernel, using the exact alias names 'auth' and 'guest' that the starter's own route groups already reference:

import 'package:magic/magic.dart';
import 'package:magic_starter/magic_starter.dart';

void registerMiddleware() {
  Kernel.registerAll({
    'auth': () => EnsureAuthenticated(),
    'guest': () => RedirectIfAuthenticated(),
  });
}

Call registerMiddleware() once from your app's bootstrap, before any route group that references 'auth' or 'guest' resolves.

EnsureAuthenticated#

Redirects an unauthenticated visitor to MagicStarterConfig.loginRoute(). It guards the login route itself so the redirect can never loop back into itself: go_router raises past five successive redirects.

MagicRoute.group(
  middleware: ['auth'],
  routes: () {
    // protected routes
  },
);

RedirectIfAuthenticated#

Redirects an already authenticated visitor to MagicStarterConfig.homeRoute(). It guards the home route itself for the same reason: a signed-in visitor landing back on home must not be redirected to home again.

A guest session (is_guest: true) is exempt and stays on the auth pages, because login and registration are where a guest becomes an account.

MagicRoute.group(
  middleware: ['guest'],
  routes: () {
    // auth pages: login, register, forgot/reset password
  },
);

Which Routes Expect Which Alias#

The starter's own route groups already assume these aliases are registered:

If your app never calls registerMiddleware(), these groups resolve to no guard at all: Kernel.resolve() returns null for an unregistered alias, and an unrecognized middleware is silently dropped from the chain rather than throwing.

Related#

• Authentication: Auth.check(), login, logout, and the routes these guards protect
• Session Scope: what resets when Auth.stateNotifier changes identity