libs/auth/src/lib/digid-auth.providers.ts

@@ -1,5 +1,10 @@
 import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
-import { authInterceptor, LogLevel, provideAuth } from 'angular-auth-oidc-client';
+import {
+  authInterceptor,
+  LogLevel,
+  provideAuth,
+  withAppInitializerAuthCheck,
+} from 'angular-auth-oidc-client';
 import { AuthService } from './auth.service';
 import { DigiadAuthService } from './digid-auth.service';
 
@@ -19,7 +24,8 @@ export interface DigiadAuthOptions {
  */
 export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProviders {
   return makeEnvironmentProviders([
-    provideAuth({
+    provideAuth(
+      {
         config: {
           authority: options.authority,
           redirectUrl: options.redirectUrl,
@@ -32,7 +38,11 @@ export function provideDigiadAuth(options: DigiadAuthOptions): EnvironmentProvid
           secureRoutes: [options.secureApiOrigin],
           logLevel: LogLevel.Warn,
         },
-    }),
+      },
+      // Run checkAuth() at startup so the DigiD callback (?code=…) is processed before the router
+      // and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
+      withAppInitializerAuthCheck(),
+    ),
     { provide: AuthService, useClass: DigiadAuthService },
   ]);
 }