Route guards

Pass routeConfig as the second argument to provideBridge in app.config.ts, then apply bridgeAuthGuard() via canActivateChild in app.routes.ts; it handles navigation guards automatically.

app.config.ts

import { ApplicationConfig } from '@angular/core';
import { provideRouter } from '@angular/router';
import { provideBridge, type BridgeConfig, type RouteGuardConfig } from '@nebulr-group/bridge-angular';
import { routes } from './app.routes';

const config: BridgeConfig = {
  appId: import.meta.env.NG_APP_BRIDGE_APP_ID,
};

const routeConfig: RouteGuardConfig = {
  rules: [
    { match: '/', public: true },
    { match: new RegExp('^/auth($|/)'), public: true },
    { match: '/beta/*', featureFlag: 'beta_feature', redirectTo: '/' },
  ],
  defaultAccess: 'protected',
};

export const appConfig: ApplicationConfig = {
  providers: [
    provideRouter(routes),
    provideBridge(config, routeConfig),
  ],
};

app.routes.ts

import { Routes } from '@angular/router';
import { bridgeAuthGuard } from '@nebulr-group/bridge-angular';

export const routes: Routes = [
  {
    path: '',
    canActivateChild: [bridgeAuthGuard()],
    children: [
      { path: '', component: HomeComponent },
      { path: 'auth/oauth-callback', component: OAuthCallbackComponent },
      { path: 'beta', component: BetaComponent },
      { path: 'protected', component: ProtectedComponent },
    ],
  },
];

Framework note: bridgeAuthGuard() returns a standard Angular CanActivateFn. Applying it via canActivateChild on a parent route checks every child route automatically, so you don’t add it to each route individually. It reads the rules from the routeConfig you passed to provideBridge.

How it works:

Option	What it does
defaultAccess	Sets whether unmatched routes are 'public' or 'protected'.
rules	Marks individual paths as public and/or gates them behind feature flags.
Unauthenticated access	Unauthenticated users hitting a protected route are redirected to Bridge’s hosted login page.

Redirects are handled automatically by bridgeAuthGuard(). For the full RouteRule shape, and the billing paywall redirect driven by billing.paywallRoute, see the config reference.