@marsaude/devtools-shell 0.1.3 → 0.1.5

package/fesm2022/marsaude-devtools-shell.mjs

@@ -641,7 +641,7 @@ const DEVTOOLS_CONFIG = new InjectionToken('DEVTOOLS_CONFIG');
 /**
  * Plain localStorage wrapper owned by the package. DevTools-internal keys are
  * prefixed `DEVTOOLS_`; the *active app session* keys (`JWT_TOKEN`,
- * `JWT_REFRESH_TOKEN`, `APP_USER`) are written deliberately so the host patient
+ * `JWT_REFRESH_TOKEN`, `EGRET_USER`) are written deliberately so the host patient
  * app consumes them — that is the only intentional touch-point with the host.
  */
 class DevtoolsStorage {
@@ -1562,10 +1562,11 @@ const devtoolsHttpInterceptor = (req, next) => {
 const SESSIONS_KEY = 'DEVTOOLS_SESSIONS';
 const ACTIVE_KEY = 'DEVTOOLS_ACTIVE';
 // The active app session — read by the HOST patient app. This is the ONE
-// intentional touch-point with the host.
+// intentional touch-point with the host, so these keys MUST match the host's
+// JwtAuthService exactly and must never change.
 const JWT_TOKEN = 'JWT_TOKEN';
 const JWT_REFRESH_TOKEN = 'JWT_REFRESH_TOKEN';
-const APP_USER = 'APP_USER';
+const APP_USER = 'EGRET_USER';
 /**
  * Manages the *active app session* that the host patient app consumes, letting
  * the QA switch it between the fixed admin (the DevTools identity) and any saved
@@ -1601,7 +1602,12 @@ class DevtoolsSessionService {
         this.storage.set(SESSIONS_KEY, next);
         return full;
     }
-    /** Write a stored session into the host's active-session keys. */
+    /**
+     * Write a stored session into the host's active-session keys and send the user
+     * to '/' (full navigation) so the host app re-reads it from a clean route — it
+     * only reads these keys at bootstrap. Covers both a fresh login and switching
+     * between users.
+     */
     switchTo(id) {
         const session = id === 'admin' ? this.admin() : this._sessions().find((s) => s.id === id) ?? null;
         if (!session)
@@ -1611,6 +1617,12 @@ class DevtoolsSessionService {
         this.storage.set(APP_USER, session.profile ?? null);
         this.activeId.set(id);
         this.storage.set(ACTIVE_KEY, id);
+        try {
+            window.location.href = '/';
+        }
+        catch {
+            /* non-browser env — ignore */
+        }
         return session;
     }
     removeSession(id) {