Patterns / Auth route-group contract
Auth route-group contract.
SvelteKit route groups encode auth state. The folder structure IS the contract for 'can this user be here?' — new routes inherit their guard by where they're placed.
Folder tree
src/routes/
+layout.svelte Root chrome (no guards)
+page.svelte public Marketing landing — public
(auth)/ auth Unauthenticated-only group
+layout.server.ts auth Redirect logged-in → /dashboard
login/+page.svelte auth
signup/+page.svelte auth
reset/+page.svelte auth
(onboarding)/ onboarding Session + incomplete application
+layout.server.ts onboarding Redirect completed → /dashboard, no-session → /login
apply/+page.svelte onboarding
(protected)/ protected Session required
+layout.server.ts protected Redirect no-session → /login
dashboard/+page.svelte protected
(2fa)/ 2fa Session + verified 2FA
+layout.server.ts 2fa Redirect unverified → /verify-2fa
settings/+page.svelte 2fa
admin/+page.svelte 2fa
unauthenticated-only in-flight application session required 2FA-verified only