auth fix?

src/app/routes/__root.tsx

@@ -4,6 +4,7 @@ import {
   Outlet,
   Scripts,
   createRootRouteWithContext,
+  isRedirect,
 } from "@tanstack/react-router";
 import * as React from "react";
 import { DefaultCatchBoundary } from "@/components/DefaultCatchBoundary";
@@ -124,6 +125,8 @@ export const Route = createRootRouteWithContext<{
       );
       return { auth };
     } catch (error: any) {
+      if (isRedirect(error) || error instanceof Response) throw error;
+
       if (typeof window !== 'undefined') {
         const { doesSessionExist, attemptRefreshingSession } = await import('supertokens-web-js/recipe/session');
 

src/app/routes/refresh-session.tsx

@@ -29,9 +29,16 @@ function RouteComponent() {
           const urlParams = new URLSearchParams(window.location.search);
           const redirect = urlParams.get('redirect');
 
-          if (redirect && !redirect.includes('_serverFn') && !redirect.includes('/api/')) {
+          const safe =
+            redirect &&
+            redirect.startsWith('/') &&
+            !redirect.startsWith('/refresh-session') &&
+            !redirect.includes('_serverFn') &&
+            !redirect.includes('/api/');
+
+          if (safe) {
             logger.info("Refresh session route: redirecting to", redirect);
-            window.location.href = decodeURIComponent(redirect);
+            window.location.href = redirect;
           } else {
             logger.info("Refresh session route: redirecting to home");
             window.location.href = '/';