Repository navigation
fix(auth): clear the previous account's persisted state when a different account signs in - #1287
JamieRuderman wants to merge 7 commits into
Conversation
…ent account signs in
…count's chat popouts on a switch
… with the other persisted models
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
…ale-state # Conflicts: # frontend/src/models/auth.test.ts
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c643950bef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // Switching accounts reloads without signing out, so persisted state and open chat popouts can be the last account's. | ||
| await rehydrated() | ||
| const owner = store.getState().user.id | ||
| if (owner && user?.id && owner !== user.id) { |
There was a problem hiding this comment.
When the previous account's user.fetch failed or never completed, user.id remains empty even though independently fetched models such as accounts, devices, and organizations can already be persisted. This condition treats that cache as safe, skips every reset, and then line 312 stamps the new account's ID onto it, so the previous account's data can render under the new account and future boots will no longer detect the mismatch. An absent owner must be treated as untrusted persisted state rather than implicitly belonging to the signing-in account.
Useful? React with 👍 / 👎.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d21a913c2e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const owner = store.getState().user.id | ||
| if (user?.id && owner !== user.id) { | ||
| auth.resetAccountData() | ||
| if (owner) broadcastChatSignout() |
There was a problem hiding this comment.
When the previous account's user.fetch failed or had not completed, user.id can be empty even though that account already opened a chat popout. This branch now resets the main window but suppresses the sign-out broadcast, so after the account-switch reload the old popout remains paired through the main tab's session-storage owner ID and can later hand its previous account's transcript back into the new account. Distinguish main windows from support/popout windows when deciding whether to broadcast rather than using owner truthiness.
Useful? React with 👍 / 👎.
…d always close stale popouts there
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This branch has not been deployed
1 participant
Problem
Sign-out resets every persisted model, but switching accounts never signs out. Activating a saved account, the add-account chooser, the desktop deep-link callback and a support launch all reload or redirect without calling
signedOut. redux-persist then rehydrates the previous account's devices, accounts, selected organization, connections, announcements and more under the new account until each fetch replaces them.Seen in practice: after switching from jamie@remote.it to a test account in the same browser, the test account ran on Jamie's persisted state.
Change
auth.fetchUsercompares the persisteduser.idwith the account that just signed in. When they differ, or when no owner was recorded, it runsresetAccountData()beforeauth.useris set, so nothing renders from another account's data. Every switch path reaches this point.auth.initisn't gated on redux-persist, so the check waits for the persistor to bootstrap before reading the owner.user.idis written at sign-in instead of when the cloud sync'suser.fetchlands. A second quick switch still sees an owner.resetAccountData()resets every persisted model, chat included, andsignedOutuses it too. The persist whitelist moved toPERSISTED_MODELS, and a test fails if the two drift apart.persistsStateinstore.tsis the one flag for both the storage choice and the check.Not covered
Other already-open web tabs keep the previous account's in-memory state until they reload, because sign-in tokens are shared across the browser. That predates this change and would need tabs to signal each other.
Testing
npm test -w=frontendandnpm run typecheckpass.