atomic-design-poc/apps/ssp/src/app/app.routes.ts

import { Routes } from '@angular/router';
import { ShellComponent } from '@shared/layout/shell/shell.component';
import { authGuard, capabilityGuard } from '@auth/auth.guard';
import { flushPendingGuard } from '@shared/application/pending-saves';

export const routes: Routes = [
  {
    path: '',
    component: ShellComponent, // persistent header/footer; only children swap
    children: [
      { path: '', pathMatch: 'full', redirectTo: 'login' },
      {
        path: 'login',
        loadComponent: () => import('@auth/ui/login.page').then((m) => m.LoginPage),
      },
      {
        // Path stays 'dashboard' on purpose: it is a user-visible URL and four e2e
        // specs assert it. The context is `overzicht`; only the path string differs.
        path: 'dashboard',
        canActivate: [authGuard],
        loadComponent: () => import('@overzicht/ui/overzicht.page').then((m) => m.OverzichtPage),
      },
      {
        path: 'registratie',
        canActivate: [authGuard],
        loadComponent: () =>
          import('@registratie/ui/registration-detail.page').then((m) => m.RegistrationDetailPage),
      },
      {
        path: 'aanvraag/:id',
        canActivate: [authGuard],
        loadComponent: () =>
          import('@registratie/ui/aanvraag-detail.page').then((m) => m.AanvraagDetailPage),
      },
      {
        path: 'registreren',
        canActivate: [authGuard],
        // Autosave wizard: flush the pending debounced draft before leaving (pending-saves.ts).
        canDeactivate: [flushPendingGuard],
        loadComponent: () =>
          import('@registratie/ui/registratie.page').then((m) => m.RegistratiePage),
      },
      {
        path: 'herregistratie',
        canActivate: [authGuard],
        canDeactivate: [flushPendingGuard],
        loadComponent: () =>
          import('@herregistratie/ui/herregistratie.page').then((m) => m.HerregistratiePage),
      },
      {
        path: 'intake',
        canActivate: [authGuard],
        canDeactivate: [flushPendingGuard],
        loadComponent: () => import('@herregistratie/ui/intake.page').then((m) => m.IntakePage),
      },
      {
        path: 'brief',
        canActivate: [authGuard],
        canDeactivate: [flushPendingGuard],
        loadComponent: () => import('@brief/ui/brief.page').then((m) => m.BriefPage),
      },
      {
        path: 'brief/huisstijl',
        // Admin-only org-template editor: capabilityGuard denies-by-default
        // unless GET /me resolved `orgtemplate:edit` (Admin role). Backend re-enforces
        // via the OrgAdmin gate — the guard just avoids loading a page that would 403.
        canActivate: [capabilityGuard('orgtemplate:edit')],
        canDeactivate: [flushPendingGuard],
        loadComponent: () => import('@brief/ui/org-template.page').then((m) => m.OrgTemplatePage),
      },
      {
        path: 'beheer/stamdata',
        // Admin-only stamdata maintenance editor (ADR-0004): capabilityGuard denies-by-default
        // unless GET /me resolved `stamdata:edit` (Admin role). Backend re-enforces via the
        // StamdataAdmin gate — the guard just avoids loading a page that would 403.
        canActivate: [capabilityGuard('stamdata:edit')],
        loadComponent: () => import('@beheer/ui/stamdata.page').then((m) => m.StamdataPage),
      },
      {
        path: 'beheer/zaken',
        // Admin-only cases overview + delete: capabilityGuard denies-by-default
        // unless GET /me resolved `cases:manage` (Admin role). Backend re-enforces via the
        // CasesAdmin gate — the guard just avoids loading a page that would 403. The page
        // lives in registratie/ui (which owns the Aanvraag aggregate); routed under /beheer.
        canActivate: [capabilityGuard('cases:manage')],
        loadComponent: () =>
          import('@registratie/ui/admin-cases.page').then((m) => m.AdminCasesPage),
      },
      {
        path: 'beheer/audit',
        // Admin-only authz/PII-reveal audit trail. capabilityGuard denies-by-default
        // unless GET /me resolved `cases:manage` (reused for audit read). Backend re-enforces.
        canActivate: [capabilityGuard('cases:manage')],
        loadComponent: () => import('@beheer/ui/audit.page').then((m) => m.AuditPage),
      },
      {
        path: 'beheer/functies',
        // Admin-only feature-flag toggles, gated by `flags:manage`.
        canActivate: [capabilityGuard('flags:manage')],
        loadComponent: () =>
          import('@beheer/ui/feature-flags.page').then((m) => m.FeatureFlagsPage),
      },
      {
        path: 'concepts',
        loadComponent: () => import('./showcase/concepts.page').then((m) => m.ConceptsPage),
      },
      { path: '**', redirectTo: 'login' },
    ],
  },
];