fix: preserve escape hatch through login redirect

platform/wab/src/wab/client/ep/dashboard-restriction.spec.ts

@@ -64,6 +64,18 @@ describe("isDashboardRestricted", () => {
     });
     expect(isDashboardRestricted(config, "?adminDashboard=true")).toBe(false);
   });
+
+  it("returns false when escape hatch is inside continueTo param", () => {
+    const config = makeAppConfig({ hideDashboardViews: true });
+    expect(
+      isDashboardRestricted(config, "?continueTo=%2F%3FadminDashboard%3Dtrue")
+    ).toBe(false);
+  });
+
+  it("returns true when continueTo has no query string", () => {
+    const config = makeAppConfig({ hideDashboardViews: true });
+    expect(isDashboardRestricted(config, "?continueTo=%2F")).toBe(true);
+  });
 });
 
 describe("redirectToDashboard", () => {
@@ -213,4 +225,14 @@ describe("shouldRedirectAuthRoute", () => {
       shouldRedirectAuthRoute(restrictedConfig, "/login/callback", "")
     ).toBe(true);
   });
+
+  it("does not redirect when escape hatch is inside continueTo param", () => {
+    expect(
+      shouldRedirectAuthRoute(
+        restrictedConfig,
+        "/login",
+        "?continueTo=%2F%3FadminDashboard%3Dtrue"
+      )
+    ).toBe(false);
+  });
 });

platform/wab/src/wab/client/ep/dashboard-restriction.ts

@@ -9,7 +9,20 @@ import { DevFlagsType } from "@/wab/shared/devflags";
 function hasEscapeHatch(appConfig: DevFlagsType, locationSearch: string): boolean {
   const paramName = appConfig.adminDashboardOverrideParam || "adminDashboard";
   const params = new URLSearchParams(locationSearch);
-  return params.get(paramName) === "true";
+  if (params.get(paramName) === "true") {
+    return true;
+  }
+  // Check inside continueTo param — the escape hatch gets encoded there
+  // when redirecting unauthenticated users to the login page.
+  const continueTo = params.get("continueTo");
+  if (continueTo) {
+    const qIdx = continueTo.indexOf("?");
+    if (qIdx !== -1) {
+      const innerParams = new URLSearchParams(continueTo.substring(qIdx));
+      return innerParams.get(paramName) === "true";
+    }
+  }
+  return false;
 }
 
 /** True when dashboard routes should be locked down. */