From 986dab7334a9f2cc06b38511e65ec8579feef7c5 Mon Sep 17 00:00:00 2001 From: Claudio Date: Mon, 18 May 2026 19:49:57 +0000 Subject: [PATCH] Clear TanStack Query cache on session change Sidebar counts, marks, folder counts, etc. were keyed only on query name, not on the authenticated user. Logging in as a non-admin kept rendering the previous admin session's data because the cache was never invalidated. clearSession and adoptSession now wipe the cache so each identity starts fresh. User-observed: the "test" user (role guest, BasePath="") saw the admin library counts in the left sidebar after signing in. --- web/src/lib/stores/session.svelte.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/web/src/lib/stores/session.svelte.ts b/web/src/lib/stores/session.svelte.ts index 06d60e4..5ae3b12 100644 --- a/web/src/lib/stores/session.svelte.ts +++ b/web/src/lib/stores/session.svelte.ts @@ -1,4 +1,5 @@ import { browser } from '$app/environment'; +import { queryClient } from '$lib/queryClient'; import type { PpClientConfig, PpSessionResponse, PpUser } from '$lib/types/photoprism'; const STORAGE_KEY = 'pp_session'; @@ -49,6 +50,13 @@ export function isAuthenticated(): boolean { } export function adoptSession(resp: PpSessionResponse, cfg?: PpClientConfig): void { + // Drop any cached data from the prior identity before installing the + // new session. The TanStack cache is keyed on query name, not user — + // so without an explicit clear, the new login keeps showing the + // previous user's `/api/v1/config.count`, marks, folder counts, etc. + // (Hit this with the `test` user seeing the admin's library counts + // in the left sidebar.) + queryClient.clear(); session.id = resp.id; session.accessToken = resp.access_token; session.previewToken = (cfg ?? resp.config)?.previewToken ?? ''; @@ -64,6 +72,10 @@ export function clearSession(): void { session.downloadToken = null; session.user = null; if (browser) localStorage.removeItem(STORAGE_KEY); + // Same reasoning as adoptSession — wipe the cache so the next user + // who logs in (or the login screen itself) doesn't render with the + // previous identity's data. + queryClient.clear(); } function persist(): void {