Use route truthiness check instead of hasAuthToken to fix both issues

The hasAuthToken() guard didn't fix Expensify#90880 because the real problem is
navigating to an empty route ('') when the user visits the root URL and
signs in. After login, hasAuthToken() returns true, and the selector
returns true for empty onboarding objects, so Navigation.navigate('')
fires and shows "not found".

The fix checks that route is truthy (non-empty) before allowing deeplink
navigation for non-anonymous users. This prevents empty-route navigation
(fixing Expensify#90880) while preserving deeplink-then-login flows like /concierge
(preserving the Expensify#82818 fix from PR Expensify#85740).

Co-authored-by: mkhutornyi <mkhutornyi@users.noreply.github.com>

Author: MelvinBot

src/libs/actions/Link.ts

@@ -32,7 +32,7 @@ import SCREENS from '@src/SCREENS';
 import {hasCompletedGuidedSetupFlowSelector} from '@src/selectors/Onboarding';
 import type {Beta, IntroSelected, Report} from '@src/types/onyx';
 import {doneCheckingPublicRoom, navigateToConciergeChat, openReport} from './Report';
-import {canAnonymousUserAccessRoute, hasAuthToken, isAnonymousUser, signOutAndRedirectToSignIn, waitForUserSignIn} from './Session';
+import {canAnonymousUserAccessRoute, isAnonymousUser, signOutAndRedirectToSignIn, waitForUserSignIn} from './Session';
 import {setOnboardingErrorMessage} from './Welcome';
 
 let currentUserEmail = '';
@@ -364,11 +364,11 @@ function openReportFromDeepLink(
                             }
                         };
 
-                        // We must check hasAuthToken() dynamically (not the stale `isAuthenticated` closure value)
-                        // before hasCompletedGuidedSetupFlowSelector because the selector returns true for empty
-                        // onboarding objects (the pre-login default state), which would cause premature deeplink
-                        // navigation before authentication completes.
-                        if ((hasAuthToken() && hasCompletedGuidedSetupFlowSelector(val)) || isAnonymousUser()) {
+                        // Guard deeplink navigation with a route truthiness check to prevent navigating to an
+                        // empty route when the user visits the root URL (e.g. new.expensify.com) and then signs in.
+                        // Without this, hasCompletedGuidedSetupFlowSelector returns true for empty onboarding objects
+                        // and Navigation.navigate('') fires, showing a "not found" page.
+                        if ((route && hasCompletedGuidedSetupFlowSelector(val)) || isAnonymousUser()) {
                             handleDeeplinkNavigation();
                         }
                     });

tests/unit/OnboardingSelectorsTest.ts

@@ -8,18 +8,24 @@ describe('onboardingSelectors', () => {
     // the onboarding flow is only showed to the users with `hasCompletedGuidedSetupFlow` set to false
     describe('hasCompletedGuidedSetupFlowSelector', () => {
         // Regression test: hasCompletedGuidedSetupFlowSelector returns true for empty onboarding objects (the pre-login default state).
-        // The deeplink guard in Link.ts must combine this with a dynamic hasAuthToken() check to prevent premature navigation.
-        it('Should return true for empty onboarding (pre-login default), confirming the need for an auth guard in deeplink navigation', () => {
+        // The deeplink guard in Link.ts must combine this with a route truthiness check to prevent navigating to an empty route
+        // when the user visits the root URL and signs in (issue #90880).
+        it('Should return true for empty onboarding (pre-login default), confirming the need for a route check in deeplink navigation', () => {
             const emptyOnboarding = {} as OnyxValue<typeof ONYXKEYS.NVP_ONBOARDING>;
-            const hasToken = false; // simulates hasAuthToken() returning false before login
             const selectorResult = hasCompletedGuidedSetupFlowSelector(emptyOnboarding);
 
             // The selector returns true for empty objects (old/migrated accounts), which is correct for its own purpose.
             expect(selectorResult).toBe(true);
 
-            // But the deeplink guard must NOT navigate when the user has no auth token, even if the selector returns true.
-            // This is the condition from openReportFromDeepLink: (hasAuthToken() && hasCompletedGuidedSetupFlowSelector(val))
-            expect(hasToken && selectorResult).toBe(false);
+            // The deeplink guard must NOT navigate when the route is empty (root URL produces ''),
+            // even if the selector returns true. This is the condition from openReportFromDeepLink:
+            // (route && hasCompletedGuidedSetupFlowSelector(val))
+            const emptyRoute = ''; // root URL produces empty string via getRouteFromLink
+            expect(emptyRoute && selectorResult).toBeFalsy();
+
+            // But when a real deeplink route exists, navigation should proceed
+            const deeplinkRoute = 'concierge';
+            expect(deeplinkRoute && selectorResult).toBeTruthy();
         });
 
         it('Should return true if onboarding NVP is an empty object', () => {