From e89023adf508adc35bbe031d2e1fdf859f1e5499 Mon Sep 17 00:00:00 2001
From: Rotimi Best <best@classroomio.com>
Date: Sun, 14 Jun 2026 10:31:29 +0100
Subject: [PATCH] fix(org-site): redirect students away from the admin
 dashboard to the LMS

A student opening /org/[slug] on self-hosted stayed on the admin
dashboard. The existing routeUserToNextPage redirect is gated by
shouldRedirectOnAuth (login/signup/onboarding only) and runs once at app
init, so it never caught this route. Add a reactive guard in the admin
org layout that sends students to /lms, gated on
appInitApi.isInitializedAndReady so the role is actually known before
deciding (the student flag defaults to false while loading).
---
 .../src/routes/(app)/org/[slug]/+layout.svelte        | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/apps/dashboard/src/routes/(app)/org/[slug]/+layout.svelte b/apps/dashboard/src/routes/(app)/org/[slug]/+layout.svelte
index d5c8635e..531f9c6d 100644
--- a/apps/dashboard/src/routes/(app)/org/[slug]/+layout.svelte
+++ b/apps/dashboard/src/routes/(app)/org/[slug]/+layout.svelte
@@ -1,9 +1,12 @@
 <script lang="ts">
   import { page } from '$app/state';
   import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
   import * as Sidebar from '@cio/ui/base/sidebar';
   import { Skeleton } from '@cio/ui/base/skeleton';
   import { currentOrg } from '$lib/utils/store/org';
+  import { isStudentExperience } from '$lib/utils/store/app';
+  import { appInitApi } from '$features/app/init.svelte';
   import { AppHeader } from '$features/ui';
   import { PUBLIC_IS_SELFHOSTED } from '$env/static/public';
 
@@ -24,6 +27,14 @@
   $effect(() => {
     data.orgName === '*' && redirect($currentOrg.siteName);
   });
+
+  $effect(() => {
+    // Decide only once the account/role has loaded — until then the student flag
+    // defaults to false and a student is indistinguishable from an admin.
+    if (appInitApi.isInitializedAndReady && $isStudentExperience) {
+      goto(resolve('/lms', {}));
+    }
+  });
 </script>
 
 {#if PUBLIC_IS_SELFHOSTED !== 'true'}