web/src/lib/stores/session.svelte.ts

@@ -1,4 +1,5 @@
 import { browser } from '$app/environment';
+import { queryClient } from '$lib/queryClient';
 import type { PpClientConfig, PpSessionResponse, PpUser } from '$lib/types/photoprism';
 
 const STORAGE_KEY = 'pp_session';
@@ -49,6 +50,13 @@ export function isAuthenticated(): boolean {
 }
 
 export function adoptSession(resp: PpSessionResponse, cfg?: PpClientConfig): void {
+	// Drop any cached data from the prior identity before installing the
+	// new session. The TanStack cache is keyed on query name, not user —
+	// so without an explicit clear, the new login keeps showing the
+	// previous user's `/api/v1/config.count`, marks, folder counts, etc.
+	// (Hit this with the `test` user seeing the admin's library counts
+	// in the left sidebar.)
+	queryClient.clear();
 	session.id = resp.id;
 	session.accessToken = resp.access_token;
 	session.previewToken = (cfg ?? resp.config)?.previewToken ?? '';
@@ -64,6 +72,10 @@ export function clearSession(): void {
 	session.downloadToken = null;
 	session.user = null;
 	if (browser) localStorage.removeItem(STORAGE_KEY);
+	// Same reasoning as adoptSession — wipe the cache so the next user
+	// who logs in (or the login screen itself) doesn't render with the
+	// previous identity's data.
+	queryClient.clear();
 }
 
 function persist(): void {