Sign-out leaves the cached metadata (and the active-org id) in storage — the next user in the same tab is seeded with the previous user's permission-filtered app list

[os-steve]

Found while implementing #4486 (org-scoping the MetadataProvider seed cache). Filed separately and unassigned: it is a different boundary from that card, and #4486's fix does not close it.

What

AuthProvider.signOut clears only the bearer token:

async signOut() {
 const { error } = await betterAuth.signOut();
 TokenStorage.clear();
 ...
}

Nothing clears:

• the objectui:metadata:* entries in sessionStorage (written by MetadataProvider), or
• ActiveOrganizationStorage (auth-active-organization-id in localStorage).

No sign-out call site reloads the page either — AppSidebar, AppHeader, UserMenu and RemediationOverlay all just call signOut(), so the SPA keeps running and sessionStorage (which is per-tab, not per-session) survives into whatever happens next in that tab.

Why it matters

The cached app list is the per-user list: the server filters GET /api/v1/meta/:type per session (filterAppForUser, objectstack#8013), so what sits in storage is "the apps THIS user was allowed to see". If a second person signs in in the same tab — a shared or kiosk browser, a handover, a support session — MetadataProvider seeds them from that entry and they briefly read the previous user's filtered app list.

This is a cross-principal disclosure, unlike #4486, whose reader is the same signed-in user reading a workspace they are a member of. #4486 keys the seed by active organization, which is the right fix for that card and deliberately does not address this one: two users in the same org produce the same key, so the seed still hits.

The exposure is app DEFINITION metadata (name, label, icon, branding, navigation tree, required-permission names) — not record rows and not credentials. For an org-authored app the navigation tree and permission names do describe that workspace's private model, and the per-user filtering means the list itself carries "what that person had access to".

Fix shape (for whoever takes it)

Sign-out should drop the client-side caches it leaves behind — the objectui:metadata:* sessionStorage entries and ActiveOrganizationStorage — rather than relying on the tab being closed. Worth deciding at the same time whether the seed should additionally be scoped to the user/session identity, which would make the stale entry unreadable by construction instead of depending on a cleanup step being remembered on every future sign-out path. MarketplacePackagePage already has a working precedent for the purge loop (it removes every key with the objectui:metadata: prefix).

Refs #4486 (the org-keying half, in flight).

[os-support-ai]

Triage: promoted to pm:queue, type Bug — cross-principal disclosure on shared-tab sign-in, distinct boundary from #4486 by the card's own measurement. Scope: the sign-out purge is the commissioned fix — clear the objectui:metadata:* sessionStorage entries and ActiveOrganizationStorage on signOut() (the MarketplacePackagePage prefix-purge loop is the in-repo precedent). Recommended and in scope if it stays client-local: additionally key the seed by user/session identity so a stale entry is unreadable by construction rather than dependent on every future sign-out path remembering the cleanup — that is the error-resistant half; if it turns out to need anything beyond the client cache key, stop and report instead of widening.

Serial constraint (for the claiming seat, not a block): #4486 is in flight on the same MetadataProvider seed-cache code — its org-keying changes the exact key shape this card would extend. Do not run the two concurrently; claim after #4486's PR lands or coordinate the key shape explicitly in the claim comment.

---

Generated by Claude Code

[os-support-ai]

Claim: PM loop round 6
Session: session_01RV6yuVCxymHYE16PL9vQkE
Branch: claude/issue-5198-signout-cache-purge
Worktree: objectui-issue-5198
Domain: repo:objectui (execution seat)
File surface: packages/auth/src/AuthProvider.tsx (the signOut callback), packages/app-shell/src/providers/MetadataProvider.tsx (the seed-cache key + read), plus tests in both packages. ⛔ OUT: packages/components/src/renderers/form/** (#4259), packages/plugin-view / plugin-list (#5177, PR5231 open), packages/plugin-grid + packages/core (#5217), packages/cli (#5127, dispatched this round), packages/types (#5186 just merged — rebase, do not re-touch).
Container & model: M, mode:subagent, model: opus — the purge is mechanical, but the identity-keying half is a judgement call with a hard stop attached.
Clause-②: no — this removes stale client-side cache; it changes no contract accept/reject behaviour and widens no public surface.
Serial constraints cleared: the #4486 constraint triage attached to this card is now LIFTED — #4486 closed 13:45Z, its PR5199 (fix(app-shell): scope the metadata seed cache to the active organization) is MERGED. Nothing else open touches MetadataProvider.tsx or AuthProvider.tsx. Re-verify at your claim.

⛔ Premise re-check — the card's code quote does NOT match the file

Measured on origin/main just now. The defect holds; the card's snippet does not. The card quotes:

async signOut() {
 const { error } = await betterAuth.signOut();
 TokenStorage.clear();
 ...
}

The actual signOut in packages/auth/src/AuthProvider.tsx (~line 272) is:

const signOut = useCallback(async () => {
 setIsLoading(true);
 try {
 await client.signOut();
 setUser(null);
 setSession(null);
 setError(null);
 } catch (err) { ... } finally { setIsLoading(false); }
}, [client]);

There is no TokenStorage.clear() line in it — whatever token clearing happens is inside client.signOut(), a layer down. Do not go hunting for the quoted line and do not conclude the card is stale when you fail to find it. What the card actually asserts is still true and I re-verified both halves:

• ActiveOrganizationStorage.clear() appears in AuthProvider.tsx only in deleteOrganization and leaveOrganization. Not in signOut.
• Nothing clears the objectui:metadata:* sessionStorage entries on sign-out.
• The prefix-purge precedent is real and still there: MarketplacePackagePage.tsx (~line 288) loops keys with key.startsWith('objectui:metadata:').

The interaction the card predates — read this before choosing the key

#4486 landed after this card was filed and it changed the key shape underneath it. On current main, MetadataProvider.tsx uses objectui:metadata:{type}:{orgId} where the scope comes from ActiveOrganizationStorage.get() || NO_ORG_SCOPE, plus a migration that drops the pre-#4486 unscoped entry.

That makes ordering inside your fix load-bearing, and it is easy to get subtly wrong:

• If you clear ActiveOrganizationStorage before purging the metadata entries, the scope you would compute for a targeted purge is already gone — a scope-derived purge silently purges the wrong key (or NO_ORG_SCOPE) and leaves the real entries behind. A prefix purge does not have this failure mode. Prefer the prefix loop, and if you use anything scope-derived, say why it is safe.
• Org-keying does not close this card, and the card is explicit about why: two users in the same org compute the same key, so the seed still hits across a sign-out. Do not let the presence of :orgId in the key persuade you the problem is already solved.

Scope — the commissioned fix, and the recommended half with a hard stop

Triage ruled the scope (2026-08-18, on this card):

> the sign-out purge is the commissioned fix — clear the objectui:metadata:* sessionStorage entries and ActiveOrganizationStorage on signOut() (the MarketplacePackagePage prefix-purge loop is the in-repo precedent). Recommended and in scope if it stays client-local: additionally key the seed by user/session identity so a stale entry is unreadable by construction rather than dependent on every future sign-out path remembering the cleanup — that is the error-resistant half; if it turns out to need anything beyond the client cache key, stop and report instead of widening.

Take the identity-keying half if it stays client-local. The moment it needs a new field from the server, a new API call, or a change to what the session endpoint returns — stop and report. That is a contract question and it is mine to escalate, not yours to decide.

Tests

• The cross-principal pin, which is the point of the card: user A signs in, the app list is cached, A signs out, user B signs in in the same tab — B must not read A's list. Write it so it fails against pre-fix source.
• Sign-out clears both stores: no objectui:metadata:* key survives, and ActiveOrganizationStorage is empty.
• Do not break MetadataProvider's sessionStorage app cache is keyed by type only — after an org switch the landing resolves from the PREVIOUS org's app list (and a cached [] short-circuits initialLoading) #4486's pins. MetadataProvider.orgScopedCache.test.tsx exists and pins the org-scoped key shape plus the unscoped-entry migration. Run it; if your change requires editing it, that is a signal to re-read, not to edit — say so in the report.
• Reverse-verify: restore source, keep tests, predict the reds before running, report predicted vs observed.

Gates

Derive from your diff (scripts/pm/dispatch-gates.mjs is objectstack-only — in this repo derive from .github/workflows and package.json). Expect Lint, Type Check, the shards, changeset gates, Control Byte Scan. Changeset required (@object-ui/auth and @object-ui/app-shell); patch or minor, ⛔ never major.

⛔ Do not background a long check and end your turn — several devs hit that trap today. Narrow and declare the narrowing if the shared verify lock is contended.

Deliver

Draft PR against main, first body line Fixes #5198. Push the branch early. Return the JSON report and post it as a comment whose first line is the literal <!-- os-dev-report --> marker.

---

Generated by Claude Code