Authenticate just members of my team

[ivanvinicius]

Nextjs 15 rc & React 19 rc

REPOSITORY

In my Nextjs application I'm getting REDIRECT error on my API ROUTE HANDLER

But first, what I want to do?
I would like to implement a custom sign-in flow that accepts only members of my team. For example, my team have four emails. Durging the sign-in process I need to verify if the current email is one of my team emails. If not, the current email does not have permissions to access my application.

My first question is: How would you do this? (give me some code example)

My code below

My Root layout have two children layouts:
AuthLayout (PUBLIC ROUTES)
AppLayout.(PRIVATE ROUTES)

In My app layout I verify if user is a member of team:

export default async function AppLayout({ children }: Props) {
 const user: User | null = await currentUser()

  if (!user) {
    redirect('/api/auth/sign-out')
  }

  // getting team emails this way for now
  const authorizedEmails = env.ADMIN_MEMBERS.split(':')
  const userEmail = user.emailAddresses[0].emailAddress

  if (!authorizedEmails.includes(userEmail)) {
    redirect('/api/auth/sign-out')
  }

  return (
    <div className="grid grid-cols-app">{children}</div>
  )
}

My api route handler

import { clerkClient } from '@clerk/clerk-sdk-node'
import { auth } from '@clerk/nextjs/server'
import { cookies } from 'next/headers'
import { type NextRequest, NextResponse } from 'next/server'

export async function GET(request: NextRequest) {
  const redirectUrl = request.nextUrl.clone()
  const { sessionId, userId } = auth()

  redirectUrl.pathname = '/auth/sign-in'

  if (!sessionId || !userId) {
    cookies().delete('__clerk_db_jwt')
    cookies().delete('__session')

    return NextResponse.redirect(redirectUrl)
  }

  try {
    await clerkClient.sessions.revokeSession(sessionId)

    await clerkClient.users.deleteUser(userId)
  } catch {}

  cookies().delete('__clerk_db_jwt')
  cookies().delete('__session')

  return NextResponse.redirect(redirectUrl)
}

How can a fix the erros below?

Note there's a loop in my sign-out request