From 58aea2ab15e7626d036d07e526808e1360217ba1 Mon Sep 17 00:00:00 2001
From: Rotimi Best <best@classroomio.com>
Date: Tue, 16 Jun 2026 22:57:54 +0100
Subject: [PATCH] fix(org-site): 404 on subdomains that don't resolve to an org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A subdomain like xxazzz.myclassroomio.com set isOrgSite=true with a null
org, and the course page fell back to resolving the org from the course
itself — so courses rendered under subdomains that don't exist. Guard
the (org-site) layout so an unresolved org site 404s instead.
---
 .../src/routes/(org-site)/+layout.server.ts         | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 apps/dashboard/src/routes/(org-site)/+layout.server.ts

diff --git a/apps/dashboard/src/routes/(org-site)/+layout.server.ts b/apps/dashboard/src/routes/(org-site)/+layout.server.ts
new file mode 100644
index 00000000..d1079dcf
--- /dev/null
+++ b/apps/dashboard/src/routes/(org-site)/+layout.server.ts
@@ -0,0 +1,13 @@
+import { error } from '@sveltejs/kit';
+
+export const load = async ({ parent }) => {
+  const { org, isOrgSite } = await parent();
+
+  // An org-site subdomain that doesn't resolve to a real org must 404 rather
+  // than fall back to whatever org a requested course happens to belong to.
+  if (isOrgSite && !org) {
+    throw error(404, 'Organization not found');
+  }
+
+  return {};
+};