@open-mercato/ui 0.6.7-develop.6766.1.40c9011995 → 0.6.7-develop.6768.1.9d2c4efc43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/ui",
-  "version": "0.6.7-develop.6766.1.40c9011995",
+  "version": "0.6.7-develop.6768.1.9d2c4efc43",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -155,13 +155,13 @@
     "remark-gfm": "^4.0.1"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6766.1.40c9011995",
+    "@open-mercato/shared": "0.6.7-develop.6768.1.9d2c4efc43",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0",
     "react-is": ">=18.0.0"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6766.1.40c9011995",
+    "@open-mercato/shared": "0.6.7-develop.6768.1.9d2c4efc43",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/backend/DataTable.tsx

@@ -552,6 +552,43 @@ export function writePerspectiveSnapshot(tableId: string, snapshot: PerspectiveS
   writeVersionedPreference(key, PERSPECTIVE_SNAPSHOT_VERSION, snapshot)
 }
 
+/**
+ * Purge every browser-local DataTable perspective snapshot and active-view cookie
+ * across all tables in this origin. Snapshots persist the unsaved/live table state
+ * (column widths, order, visibility) keyed only by `tableId`, so they are shared by
+ * every account that signs in on the same browser profile. Call this at the auth
+ * identity boundary (login) so one user's unsaved layout never carries over to a
+ * different user — including a different tenant — reusing the same browser tab (#4185).
+ */
+export function clearAllPerspectiveState(): void {
+  if (typeof window !== 'undefined') {
+    try {
+      const storage = window.localStorage
+      const staleKeys: string[] = []
+      for (let index = 0; index < storage.length; index += 1) {
+        const key = storage.key(index)
+        if (key && key.startsWith(`${PERSPECTIVE_STORAGE_PREFIX}:`)) staleKeys.push(key)
+      }
+      for (const key of staleKeys) storage.removeItem(key)
+    } catch {
+      // private mode / quota errors are non-fatal
+    }
+  }
+  if (typeof document !== 'undefined') {
+    try {
+      const cookies = document.cookie ? document.cookie.split(';') : []
+      for (const cookie of cookies) {
+        const name = cookie.split('=')[0]?.trim()
+        if (name && name.startsWith(`${PERSPECTIVE_COOKIE_PREFIX}:`)) {
+          document.cookie = `${name}=; Path=/; Max-Age=0; SameSite=Lax`
+        }
+      }
+    } catch {
+      // ignore — cookie access can throw in sandboxed contexts
+    }
+  }
+}
+
 export function sanitizePerspectiveSettings(source?: PerspectiveSettings | null): PerspectiveSettings | null {
   if (!source || typeof source !== 'object') return null
   const forbidden = new Set(['__proto__', 'prototype', 'constructor'])

package/src/backend/__tests__/DataTable.perspectiveStorage.test.ts

@@ -1,7 +1,8 @@
 /** @jest-environment jsdom */
-import { readPerspectiveSnapshot, writePerspectiveSnapshot } from '../DataTable'
+import { clearAllPerspectiveState, readPerspectiveSnapshot, writePerspectiveSnapshot } from '../DataTable'
 
 const PREFIX = 'om_table_perspective_snapshot'
+const COOKIE_PREFIX = 'om_table_perspective'
 
 describe('DataTable perspective snapshot storage (versioned envelope)', () => {
   beforeEach(() => {
@@ -52,3 +53,63 @@ describe('DataTable perspective snapshot storage (versioned envelope)', () => {
     expect(localStorage.getItem(`${PREFIX}:tbl5`)).toBeNull()
   })
 })
+
+describe('clearAllPerspectiveState (tenant-isolation at the auth identity boundary, #4185)', () => {
+  beforeEach(() => {
+    localStorage.clear()
+    for (const cookie of document.cookie ? document.cookie.split(';') : []) {
+      const name = cookie.split('=')[0]?.trim()
+      if (name) document.cookie = `${name}=; Path=/; Max-Age=0`
+    }
+  })
+
+  it('removes every perspective snapshot across all tables', () => {
+    writePerspectiveSnapshot('customers-companies', {
+      perspectiveId: null,
+      settings: { columnSizing: { name: 210, status: 60 } },
+      updatedAt: 1,
+    })
+    writePerspectiveSnapshot('customers-people', {
+      perspectiveId: null,
+      settings: { columnSizing: { name: 300 } },
+      updatedAt: 2,
+    })
+
+    clearAllPerspectiveState()
+
+    expect(localStorage.getItem(`${PREFIX}:customers-companies`)).toBeNull()
+    expect(localStorage.getItem(`${PREFIX}:customers-people`)).toBeNull()
+    expect(readPerspectiveSnapshot('customers-companies')).toBeNull()
+    expect(readPerspectiveSnapshot('customers-people')).toBeNull()
+  })
+
+  it('leaves unrelated localStorage keys untouched', () => {
+    writePerspectiveSnapshot('customers-companies', {
+      perspectiveId: null,
+      settings: { columnSizing: { name: 210 } },
+      updatedAt: 1,
+    })
+    localStorage.setItem('om_login_tenant', 'acme')
+    localStorage.setItem('om:auth:identity', '123')
+
+    clearAllPerspectiveState()
+
+    expect(localStorage.getItem(`${PREFIX}:customers-companies`)).toBeNull()
+    expect(localStorage.getItem('om_login_tenant')).toBe('acme')
+    expect(localStorage.getItem('om:auth:identity')).toBe('123')
+  })
+
+  it('expires the active-view perspective cookies', () => {
+    document.cookie = `${COOKIE_PREFIX}:customers-companies=view-1; Path=/`
+    expect(document.cookie).toContain(`${COOKIE_PREFIX}:customers-companies=view-1`)
+
+    clearAllPerspectiveState()
+
+    expect(document.cookie).not.toContain(`${COOKIE_PREFIX}:customers-companies`)
+  })
+
+  it('is a no-op when nothing is stored', () => {
+    expect(() => clearAllPerspectiveState()).not.toThrow()
+    expect(localStorage.length).toBe(0)
+  })
+})