fix(mcp): применять права к прямым переходам и проверять маршрутизацию

components/auth-guard.tsx

@@ -1,17 +1,22 @@
 "use client"
 
 import { useEffect, useState, type ReactNode } from "react"
+import { usePathname } from "next/navigation"
 import {
+  can,
   ensureAuthConfig,
   getClaims,
   getToken,
   isAuthEnabled,
+  permissionForPath,
   redirectToPortalLogin,
   redirectToPortalLoginInteractive,
 } from "@/lib/auth"
 
 export function AuthGuard({ children }: { children: ReactNode }) {
+  const pathname = usePathname()
   const [ready, setReady] = useState(false)
+  const permission = pathname ? permissionForPath(pathname) : null
 
   useEffect(() => {
     let cancelled = false
@@ -28,7 +33,7 @@ export function AuthGuard({ children }: { children: ReactNode }) {
         if (!ok) redirectToPortalLoginInteractive()
         return
       }
-      if (!claims.apps.includes("mm")) {
+      if (!claims.apps.includes("mm") || (permission && !can(permission))) {
         window.location.assign("/access-denied")
         return
       }
@@ -37,9 +42,9 @@ export function AuthGuard({ children }: { children: ReactNode }) {
     return () => {
       cancelled = true
     }
-  }, [])
+  }, [pathname, permission])
 
-  if (!ready) {
+  if (!ready || (isAuthEnabled() && (!getToken() || !getClaims()?.apps.includes("mm") || (permission && !can(permission))))) {
     return (
       <div className="text-muted-foreground flex min-h-svh items-center justify-center p-6 text-sm">
         Проверка сессии…