fix(auth): handle expired session sources before permissions

The previous fix only prioritized authStore inside the route guard, so an unauthenticated NextAuth session or a suppressed access-context 401 still collapsed into an empty permission set. Propagate both authentication signals before authorization so expired sessions consistently reauthenticate.

src/app/RefineContext.tsx

@@ -56,7 +56,7 @@ type AppProps = {
   defaultMode?: string;
 };
 
-const App = (props: React.PropsWithChildren<AppProps>) => {
+export const App = (props: React.PropsWithChildren<AppProps>) => {
   const { data, status } = useSession();
   const to = usePathname();
   const setAccessToken = useAuthStore((state) => state.setAccessToken);
@@ -84,6 +84,10 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
       markSessionExpired("refresh_failed");
       return;
     }
+    if (status === "unauthenticated") {
+      markSessionExpired("unauthorized");
+      return;
+    }
     if (status === "authenticated") {
       clearSessionExpired();
     }
@@ -99,7 +103,6 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
     setAccessLoading(true);
     apiFetch(`${config.BACKEND_URL}/api/v1/access-context`, {
       projectHeaderMode: currentProjectId ? "include" : "omit",
-      skipAuthRedirect: true,
     })
       .then(async (response) => {
         if (cancelled) return;
@@ -368,7 +371,9 @@ const App = (props: React.PropsWithChildren<AppProps>) => {
               }}
             >
               <SessionExpiryDialog expiresAt={data?.sessionExpiresAt} />
-              <RoutePermissionGuard>{props.children}</RoutePermissionGuard>
+              <RoutePermissionGuard authenticated={status === "authenticated"}>
+                {props.children}
+              </RoutePermissionGuard>
               <RefineKbar />
             </Refine>
           </RefineSnackbarProvider>