diff --git a/src/app/auth/login/__tests__/page.browser.test.tsx b/src/app/auth/login/__tests__/page.browser.test.tsx
new file mode 100644
index 000000000..e40943d97
--- /dev/null
+++ b/src/app/auth/login/__tests__/page.browser.test.tsx
@@ -0,0 +1,52 @@
+/**
+ * The sign-in page, driven by its buttons.
+ *
+ * Single sign-on leaves the page for the identity provider and the session
+ * starts on the way back, so the previous account's offline copies have to
+ * be gone before the page is left.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { stubFetch } from "../../../../../tests/browser/fetch-stub";
+import { renderWithApp } from "../../../../../tests/browser/render";
+
+const clearOffline = vi.hoisted(() => vi.fn(async () => {}));
+const loadDocument = vi.hoisted(() => vi.fn());
+
+vi.mock("@/lib/pwa/query-persister", () => ({
+ clearOfflineCachesForSessionEnd: clearOffline,
+}));
+vi.mock("@/lib/navigation/load-document", () => ({ loadDocument }));
+
+import LoginPage from "../page";
+
+beforeEach(() => {
+ stubFetch()
+ .on("GET", "/api/auth/registration-status", {
+ data: { registrationEnabled: false, sessionCookieSecure: false },
+ })
+ .on("GET", "/api/auth/oidc/status", {
+ data: { enabled: true, buttonLabel: "Example ID", only: false },
+ });
+});
+
+afterEach(() => {
+ clearOffline.mockClear();
+ loadDocument.mockClear();
+});
+
+describe("sign-in page, single sign-on", () => {
+ it("clears the offline copies before leaving for the identity provider", async () => {
+ const { screen } = await renderWithApp( void handleOidcLogin()}
variant={oidcStatus.only ? "default" : "outline"}
className="min-h-11 w-full"
size="lg"
diff --git a/src/app/auth/register/__tests__/page.browser.test.tsx b/src/app/auth/register/__tests__/page.browser.test.tsx
new file mode 100644
index 000000000..798139d4d
--- /dev/null
+++ b/src/app/auth/register/__tests__/page.browser.test.tsx
@@ -0,0 +1,44 @@
+/**
+ * The registration page, driven by its form.
+ *
+ * A new account starts from an empty cache, like every other sign-in: the
+ * client cache outlives the navigation, and nothing read before the account
+ * existed belongs to it.
+ */
+import { describe, expect, it } from "vitest";
+import { page } from "vitest/browser";
+
+import { queryKeys } from "@/lib/query-keys";
+
+import { stubFetch } from "../../../../../tests/browser/fetch-stub";
+import { renderWithApp } from "../../../../../tests/browser/render";
+import RegisterPage from "../page";
+
+async function fill(selector: string, value: string): Promise {
+ await page.elementLocator(document.querySelector(selector)!).fill(value);
+}
+
+describe("registration page", () => {
+ it("starts the new account from an empty cache", async () => {
+ const api = stubFetch()
+ .on("GET", "/api/auth/me", { status: 401, error: "Unauthorized" })
+ .on("POST", "/api/auth/register", { data: { id: "new-account" } });
+ window.history.replaceState(null, "", "/auth/register");
+ const { screen, queryClient } = await renderWithApp( {
+ await expect.poll(() => document.querySelector(selector)).toBeTruthy();
+ await page.elementLocator(document.querySelector(selector)!).fill(value);
+}
+
+async function click(slot: string): Promise {
+ await page
+ .elementLocator(document.querySelector(`[data-slot="${slot}"]`)!)
+ .click();
+}
+
+describe("ClaimProfile", () => {
+ it("starts the claimed account from an empty cache", async () => {
+ const { queryClient } = await renderWithApp(
+ [0] | null) {
+ return renderWithApp(
+
+
+ ,
+ { user },
+ );
+}
+
+async function settle(): Promise {
+ await new Promise((resolve) => setTimeout(resolve, 150));
+}
+
+afterEach(() => {
+ clearOffline.mockClear();
+});
+
+describe("AuthShell on a sign-in page", () => {
+ it("clears the offline copies once the server says there is no session", async () => {
+ const fetchStub = stubFetch().on("GET", ME, {
+ status: 401,
+ error: "Unauthorized",
+ });
+ openAt("/auth/login");
+ const { queryClient } = await mountShell(null);
+
+ await expect.poll(() => clearOffline.mock.calls.length).toBe(1);
+
+ // A second answer of the same kind does not clear again.
+ await queryClient.refetchQueries();
+ await settle();
+ expect(fetchStub.calls("GET", ME).length).toBeGreaterThan(1);
+ expect(clearOffline).toHaveBeenCalledTimes(1);
+ });
+
+ it("does the same on the profile take-over page", async () => {
+ stubFetch().on("GET", ME, { status: 401, error: "Unauthorized" });
+ openAt("/auth/claim");
+ await mountShell(null);
+ await expect.poll(() => clearOffline.mock.calls.length).toBe(1);
+ });
+
+ it("leaves them alone for a signed-in visitor", async () => {
+ stubFetch();
+ openAt("/auth/register");
+ await mountShell({ id: "signed-in" });
+ await settle();
+ expect(clearOffline).not.toHaveBeenCalled();
+ });
+
+ it("leaves them alone when the answer carries no verdict", async () => {
+ // An offline launch or a 5xx says nothing about the session; clearing on
+ // it is what used to destroy the offline copies of a signed-in device.
+ const fetchStub = stubFetch().on("GET", ME, {
+ status: 503,
+ error: "Unavailable",
+ });
+ openAt("/auth/login");
+ await mountShell(null);
+ // The account query retries a 5xx once; wait for both answers.
+ await expect
+ .poll(() => fetchStub.calls("GET", ME).length, { timeout: 4000 })
+ .toBe(2);
+ await settle();
+ expect(clearOffline).not.toHaveBeenCalled();
+ });
+
+ it("does not clear on a public page outside the sign-in flow", async () => {
+ stubFetch().on("GET", ME, { status: 401, error: "Unauthorized" });
+ openAt("/about");
+ await mountShell(null);
+ await settle();
+ expect(clearOffline).not.toHaveBeenCalled();
+ });
+});
diff --git a/src/components/layout/auth-shell.tsx b/src/components/layout/auth-shell.tsx
index 2853585d0..9610fc3cc 100644
--- a/src/components/layout/auth-shell.tsx
+++ b/src/components/layout/auth-shell.tsx
@@ -15,6 +15,7 @@ import { useRecordCapabilities } from "@/hooks/use-record-capabilities";
import { useRecordSessionTransition } from "@/hooks/use-record-session-transition";
import { useTranslations } from "@/lib/i18n/context";
import { CoachLaunchProvider } from "@/lib/insights/coach-launch-context";
+import { clearOfflineCachesForSessionEnd } from "@/lib/pwa/query-persister";
// The leaf module, not the `@/lib/record-settings` barrel. This shell wraps
// every authenticated route, and the barrel also re-exports the managed
// settings-patch schemas — so one destination predicate that reads a slug
@@ -77,6 +78,32 @@ const PUBLIC_PATHS = [
"/claim/",
];
+/**
+ * A session that ended without passing through the shell's session-end wipe
+ * (an expired cookie the edge sent straight to the sign-in page, a sign-in
+ * page opened directly) left the previous account's offline copies on this
+ * device. Clear them on every `/auth/*` page once the server has said there is
+ * no session, before anyone signs in. Once per signed-out stretch, and never
+ * on an answer that is not a verdict (offline, 5xx).
+ */
+function useSignInPageOfflineWipe(pathname: string): void {
+ const { isAuthenticated, isAuthUnknown, isLoading } = useAuth();
+ const cleared = useRef(false);
+ useEffect(() => {
+ if (isAuthenticated) {
+ cleared.current = false;
+ } else if (
+ !isLoading &&
+ !isAuthUnknown &&
+ pathname.startsWith("/auth/") &&
+ !cleared.current
+ ) {
+ cleared.current = true;
+ void clearOfflineCachesForSessionEnd();
+ }
+ }, [isLoading, isAuthenticated, isAuthUnknown, pathname]);
+}
+
export function AuthShell({
children,
demoMode = false,
@@ -223,9 +250,8 @@ export function AuthShell({
// QueryClient outlives the navigation on this SPA and the health-data
// families are not user-scoped) plus the persisted IndexedDB + SW
// caches, so nothing leaks to the next account on a shared browser.
- // Logout does the same from `useLogout`; this covers the expiry path
- // logout never runs through. Best-effort; the redirect proceeds
- // regardless.
+ // Logout does the same from `useLogout`; this covers the expiry path it
+ // never runs through. Best-effort; the redirect proceeds regardless.
//
// `isAuthUnknown` = the auth probe failed WITHOUT a session verdict
// (offline relaunch, network blip, 5xx) and no prior-session marker
@@ -247,6 +273,7 @@ export function AuthShell({
router,
queryClient,
]);
+ useSignInPageOfflineWipe(pathname);
// Redirect non-admins away from /admin
useEffect(() => {