The dashboard middleware was treating /dashboard/api/v1/* as protected dashboard pages, so even the login request:

/dashboard/api/v1/auth/employee/login
was getting 307 redirected to /dashboard/sign-in. That meant sign-in could never set/read the employee_session cookie, and every dashboard page kept bouncing back to sign-in.

apps/dashboard/src/middleware.test.ts

@@ -122,4 +122,13 @@ describe('dashboard middleware', () => {
     expect(response).toEqual({ kind: 'next' })
     expect(nextServer.next).toHaveBeenCalledTimes(1)
   })
+
+  it('allows dashboard API requests through so auth endpoints can set and read cookies', async () => {
+    const { default: middleware } = await loadMiddleware()
+
+    const response = middleware(request('https://workspace.example.com/dashboard/api/v1/auth/employee/login') as never)
+
+    expect(response).toEqual({ kind: 'next' })
+    expect(nextServer.redirect).not.toHaveBeenCalled()
+  })
 })

apps/dashboard/src/middleware.ts

@@ -67,6 +67,7 @@ function isInternalHost(host: string | null): boolean {
 
 function isProtectedRoute(req: NextRequest) {
   const pathname = toDashboardAppPath(req.nextUrl.pathname)
+  if (pathname === '/api' || pathname.startsWith('/api/') || pathname === '/trpc' || pathname.startsWith('/trpc/')) return false
   if (['/sign-in', '/sign-up', '/forgot-password', '/reset-password', '/onboarding', '/verify-email'].some((p) => pathname === p || pathname.startsWith(p + '/'))) return false
   return pathname === '/' || (pathname.startsWith('/') && !pathname.startsWith('/_next'))
 }