Confines app-locked sessions (e.g. magic-link) to a single application.
When the auth provider reports a session scope locked to one app
(GetSessionScope().restrictedToApplicationId), this guard blocks activation
of any /app/:appName route that isn't the scoped app and redirects back to
it — including the always-accessible Home system app. Because it runs as a
CanActivate guard, the off-scope component never mounts, so there's no
transient render/error before the redirect.
No-op for normal (unconstrained) sessions, so it's safe on every /app route.
Confines app-locked sessions (e.g. magic-link) to a single application.
When the auth provider reports a session scope locked to one app (
GetSessionScope().restrictedToApplicationId), this guard blocks activation of any/app/:appNameroute that isn't the scoped app and redirects back to it — including the always-accessible Home system app. Because it runs as a CanActivate guard, the off-scope component never mounts, so there's no transient render/error before the redirect.No-op for normal (unconstrained) sessions, so it's safe on every /app route.