From b26a635283727fe6d4020948ff06f2f29cdfde67 Mon Sep 17 00:00:00 2001
From: maaz519 <maaz@insigniaconsultancy.com>
Date: Sat, 20 Jun 2026 17:17:54 +0530
Subject: [PATCH] fix: exclude /org paths from tenant auth guard in sidebar
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

/org/* is the org-admin portal — it has its own auth context and should
not redirect to /login. Add ORG_PATHS bypass and render null sidebar
on those routes (same pattern as /my/*).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 apps/web/app/_lib/sidebar.tsx | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/apps/web/app/_lib/sidebar.tsx b/apps/web/app/_lib/sidebar.tsx
index 58ca1be..c941c00 100644
--- a/apps/web/app/_lib/sidebar.tsx
+++ b/apps/web/app/_lib/sidebar.tsx
@@ -25,6 +25,7 @@ const SUPER_ADMIN_LINKS = [
 const PUBLIC_PATHS = ['/login', '/signup', '/onboard', '/member-login'];
 const ADMIN_PATHS = ['/admin'];
 const MEMBER_PATHS = ['/my'];
+const ORG_PATHS = ['/org'];
 
 export function Sidebar() {
   const { admin, loading, logout } = useAuth();
@@ -45,6 +46,7 @@ export function Sidebar() {
     if (PUBLIC_PATHS.some((p) => pathname.startsWith(p))) return;
     if (ADMIN_PATHS.some((p) => pathname.startsWith(p))) return;
     if (MEMBER_PATHS.some((p) => pathname.startsWith(p))) return;
+    if (ORG_PATHS.some((p) => pathname.startsWith(p))) return;
     if (!admin) {
       router.replace(`/login?next=${encodeURIComponent(pathname)}`);
     }
@@ -90,6 +92,10 @@ export function Sidebar() {
     return null;
   }
 
+  if (ORG_PATHS.some((p) => pathname.startsWith(p))) {
+    return null;
+  }
+
   return (
     <nav className="w-52 shrink-0 bg-white border-r border-gray-200 p-4 flex flex-col">
       <span className="font-bold text-base mb-4">TOWER</span>