Handle unauthenticated request

[asacarter]

The template does not have any configuration settings for the login route.

It automatically redirects to auth/login. I would like to specify my own route to an unauthenticated page or have it just return unauthenticated so I can handle my own logic if a user is not authenticated.

const { admin } = await authenticate.admin(request);

[paulomarg]

Hey, thanks for raising this! Just to help me understand the problem better, could you please clarify:

1. are you trying to create an unauthenticated endpoint?
2. or are you trying to handle the "error" scenario of authenticate.admin differently?

If it's number 2, and you simply want to override the auth/login endpoint, it's in the template in app/routes/auth.login/route.tsx.

One option would be to skip the await login(request) calls in that file, which are what trigger the automatic redirection in the template. That page will by default show a login form if there is no shop parameter, or trigger a login if there is one.

Hope this helps!

[asacarter]

Hi Paulo,

Thanks for the quick reply and it was also nice to meet you at Editions.

It's neither of those, it's that I would like to choose my own routes.

I'd like to do an auth check on the index route. If they are not logged in, redirect to a different login route other than auth/login. If the user is authenticated then continue in the same route rather than redirecting to app/.

In the index route, If I add the auth check to the loader I found that if not authenticated, it performs the redirect to auth/login automatically.

export const loader = async ({ request }) => {
  const { admin } = await authenticate.admin(request);
...
}

It would be great if I could pass in an additional parameter to authenticate.admin. Something like authenticate.admin(request, true) and have it return if authenticated or not instead of automatically redirecting.

Then I can create my own routes rather than being restricted to auth/login and app/.

It would also be useful for API endpoints, where you don't necessarily need a redirection.

[paulomarg]

I see, I think that's a great point - so you basically want to be able to call the authentication but handle the failure cases yourself.

I like the idea, but it's worth pointing out that there are quite a few edge cases in that authentication that we need to be mindful of, so we'd need to do some thinking on it.

In any case, I'll bring it to the team and get back to you!