From 0c4b6ab8bacd293616a42503cb3e0d744e38e551 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sun, 14 Jun 2026 10:46:01 +0200
Subject: [PATCH] fix(pwa): wipe the page cache on logout

Now that the service worker is registered app-wide, cached navigation
HTML survives a logout. The everyday routes carry no server-rendered PII,
but on a shared device a clean session boundary should leave nothing in
CacheStorage. On a successful logout, best-effort delete the
`healthlog-pages-*` caches. The static cache (hashed chunks, icons) is
left intact so the next login does not re-download the shell. The wipe
never blocks the redirect to the login page.
---
 src/hooks/use-auth.ts | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/src/hooks/use-auth.ts b/src/hooks/use-auth.ts
index 6006c06a5..246a805fa 100644
--- a/src/hooks/use-auth.ts
+++ b/src/hooks/use-auth.ts
@@ -156,6 +156,19 @@ export function useLogout() {
     onSuccess: () => {
       queryClient.setQueryData(queryKeys.authMe(), null);
       queryClient.invalidateQueries({ queryKey: queryKeys.auth() });
+      // Defense-in-depth at the session boundary: wipe the service-worker
+      // page cache so no cached navigation HTML survives a logout on a
+      // shared device. Scoped to `healthlog-pages-*` only — the static
+      // cache (hashed chunks, icons) carries no PII and dropping it would
+      // force a needless re-download on the next login. Best-effort; never
+      // blocks the redirect.
+      if (typeof caches !== "undefined") {
+        void caches.keys().then((keys) => {
+          for (const key of keys) {
+            if (key.startsWith("healthlog-pages-")) void caches.delete(key);
+          }
+        });
+      }
       router.push("/auth/login");
     },
     // v1.16.4 — a network-failed logout used to do nothing at all (the