@oxyhq/services 13.0.2 → 13.0.3

package/src/ui/components/AccountSwitcher.tsx

@@ -111,12 +111,12 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
     const {
         activeSessionId,
         switchSession,
+        switchToAccount,
         removeSession,
         logout,
         logoutAll,
         accounts,
-        actingAs,
-        setActingAs,
+        user,
         oxyServices,
     } = useOxy();
     const { t, locale } = useI18n();
@@ -125,6 +125,7 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
     const { accounts: deviceAccounts } = useDeviceAccounts();
 
     const [busySessionId, setBusySessionId] = useState<string | null>(null);
+    const [switchingAccountId, setSwitchingAccountId] = useState<string | null>(null);
     const [removingSessionId, setRemovingSessionId] = useState<string | null>(null);
     const [signingOut, setSigningOut] = useState(false);
     const [signingOutAll, setSigningOutAll] = useState(false);
@@ -140,19 +141,37 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
         return [...current, ...others];
     }, [deviceAccounts]);
 
-    const isSwitching = busySessionId !== null;
+    const isSwitching = busySessionId !== null || switchingAccountId !== null;
     const actionDisabled = isSwitching || signingOut || signingOutAll;
 
+    // Account ids that are already signed in as REAL device sessions. After a
+    // `switchToAccount` the target becomes a device session (and the personal
+    // account always is one), so it would otherwise appear BOTH as a device row
+    // (Section A) and a graph row (Section B). We dedupe by hiding such accounts
+    // from the graph — they show in Section A, where the active one is flagged
+    // current.
+    const deviceUserIds = useMemo<Set<string>>(
+        () => new Set(deviceAccounts.map((account) => account.user.id).filter((id): id is string => Boolean(id))),
+        [deviceAccounts],
+    );
+
     // --- Account graph (Section B) ---
+    // The switchable graph minus accounts that are already device sessions
+    // (deduped into Section A). This is the set Section B renders and searches.
+    const graphAccounts = useMemo<AccountNode[]>(
+        () => accounts.filter((node) => !deviceUserIds.has(node.accountId)),
+        [accounts, deviceUserIds],
+    );
+
     const filtered = useMemo<AccountNode[]>(() => {
         const q = query.trim().toLowerCase();
-        if (!q) return accounts;
-        return accounts.filter((node) => {
+        if (!q) return graphAccounts;
+        return graphAccounts.filter((node) => {
             const name = getAccountDisplayName(node.account, locale).toLowerCase();
             const username = (node.account?.username ?? '').toLowerCase();
             return name.includes(q) || username.includes(q);
         });
-    }, [accounts, query, locale]);
+    }, [graphAccounts, query, locale]);
 
     const yourAccounts = useMemo(
         () => toTree(filtered.filter((node) => node.relationship !== 'member')),
@@ -165,11 +184,8 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
 
     const handleSwitchDevice = useCallback(async (sessionId: string) => {
         if (busySessionId) return;
-        // Tapping the already-active sign-in returns to that sign-in's own
-        // personal account (clearing any account-graph switch). When already on
-        // the personal account this just closes.
+        // Tapping the already-active sign-in just closes — it IS the current account.
         if (sessionId === activeSessionId) {
-            if (actingAs !== null) setActingAs(null);
             onClose();
             return;
         }
@@ -177,9 +193,6 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
         try {
             await onBeforeSessionChange?.();
             await switchSession(sessionId);
-            // The active sign-in changed; any account-graph switch belonged to the
-            // previous sign-in, so the new sign-in starts on its personal account.
-            if (actingAs !== null) setActingAs(null);
             toast.success(t('accountSwitcher.toasts.switchSuccess') || 'Switched account');
             onClose();
         } catch (error) {
@@ -190,7 +203,7 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
         } finally {
             setBusySessionId(null);
         }
-    }, [activeSessionId, busySessionId, actingAs, setActingAs, switchSession, t, onClose, onBeforeSessionChange]);
+    }, [activeSessionId, busySessionId, switchSession, t, onClose, onBeforeSessionChange]);
 
     const handleRemoveDevice = useCallback(async (sessionId: string) => {
         if (sessionId === activeSessionId || removingSessionId) return;
@@ -238,18 +251,40 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
         }
     }, [signingOutAll, logoutAll, t, onClose, onBeforeSessionChange]);
 
-    const handleSelectAccount = useCallback((node: AccountNode) => {
-        // The personal (self) account = no delegation (acting-as null).
-        setActingAs(node.relationship === 'self' ? null : node.accountId);
-        onClose();
-    }, [setActingAs, onClose]);
+    const handleSelectAccount = useCallback(async (node: AccountNode) => {
+        if (switchingAccountId) return;
+        // Already the active account → just close (it would also be deduped from
+        // the graph, but guard defensively).
+        if (node.accountId === user?.id) {
+            onClose();
+            return;
+        }
+        setSwitchingAccountId(node.accountId);
+        try {
+            await onBeforeSessionChange?.();
+            // Switching INTO a graph account is a REAL session switch — the whole
+            // app becomes that account (no delegation header).
+            await switchToAccount(node.accountId);
+            toast.success(t('accountSwitcher.toasts.switchSuccess') || 'Switched account');
+            onClose();
+        } catch (error) {
+            if (!isDev()) {
+                loggerUtil.warn('Switch account failed', { component: 'AccountSwitcher' }, error as unknown);
+            }
+            toast.error(t('accountSwitcher.toasts.switchFailed') || 'Failed to switch account');
+        } finally {
+            setSwitchingAccountId(null);
+        }
+    }, [switchingAccountId, user?.id, switchToAccount, t, onClose, onBeforeSessionChange]);
 
     const renderAccountNode = useCallback((node: AccountNode, isChild: boolean) => {
         const displayName = getAccountDisplayName(node.account, locale);
         const username = node.account?.username ? `@${node.account.username}` : null;
-        const active = node.relationship === 'self'
-            ? actingAs === null
-            : actingAs === node.accountId;
+        // Current account = the active session's user. After a real-session
+        // switch `user` IS this account (such accounts are normally deduped out of
+        // the graph, but the check stays correct/defensive if one lingers).
+        const active = node.accountId === user?.id;
+        const isNodeSwitching = switchingAccountId === node.accountId;
         const role = node.callerMembership?.role;
         const avatarUri = node.account?.avatar
             ? oxyServices.getFileDownloadUrl(node.account.avatar, 'thumb')
@@ -267,11 +302,13 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
                 accessibilityLabel={displayName}
                 accessibilityState={{ selected: active }}
                 onPress={() => handleSelectAccount(node)}
+                disabled={isSwitching}
                 activeOpacity={0.6}
                 style={[
                     styles.accountRow,
                     isChild && styles.childRow,
                     active && { backgroundColor: colors.primarySubtle },
+                    isSwitching && !isNodeSwitching && styles.rowDisabled,
                 ]}
             >
                 <Avatar uri={avatarUri} name={displayName} size={isChild ? 28 : 34} />
@@ -305,10 +342,14 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
                         <Ionicons name="settings-outline" size={16} color={colors.textSecondary} />
                     </TouchableOpacity>
                 ) : null}
-                {active ? <Ionicons name="checkmark" size={20} color={colors.primary} /> : null}
+                {isNodeSwitching ? (
+                    <ActivityIndicator color={colors.primary} size="small" />
+                ) : active ? (
+                    <Ionicons name="checkmark" size={20} color={colors.primary} />
+                ) : null}
             </TouchableOpacity>
         );
-    }, [actingAs, colors, handleSelectAccount, locale, onOpenAccountSettings, oxyServices, t]);
+    }, [user?.id, switchingAccountId, isSwitching, colors, handleSelectAccount, locale, onOpenAccountSettings, oxyServices, t]);
 
     const renderTree = useCallback((entries: TreeEntry[]) => (
         entries.map((entry) => (
@@ -333,11 +374,9 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
             {deviceRows.map((row) => {
                 const isBusy = busySessionId === row.sessionId;
                 const isRemoving = removingSessionId === row.sessionId;
-                // The active sign-in is THE current account only when no
-                // account-graph switch is in effect; otherwise a switched-into
-                // account is current and this row reads as the signed-in (but not
-                // active) account — tappable to return to it.
-                const isCurrentAccount = row.isActive && actingAs === null;
+                // The active device session IS the current account — there is no
+                // separate acting-as concept; switching makes `user` that account.
+                const isCurrentAccount = row.isActive;
                 return (
                     <TouchableOpacity
                         key={`device-${row.sessionId}`}
@@ -371,11 +410,6 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
                             <ActivityIndicator color={colors.primary} size="small" />
                         ) : isCurrentAccount ? (
                             <Ionicons name="checkmark" size={20} color={colors.primary} />
-                        ) : row.isActive ? (
-                            // Active sign-in while switched into another account:
-                            // no current-checkmark, no sign-out (can't sign out the
-                            // active session here) — tap the row to return to it.
-                            null
                         ) : isRemoving ? (
                             <ActivityIndicator color={colors.textSecondary} size="small" />
                         ) : (
@@ -420,12 +454,12 @@ export const AccountSwitcherView: React.FC<AccountSwitcherActions> = ({
                 </Text>
             </TouchableOpacity>
 
-            {/* Section B — account graph */}
-            {accounts.length > 0 ? (
+            {/* Section B — account graph (switchable accounts not already a device session) */}
+            {graphAccounts.length > 0 ? (
                 <>
                     <Divider color={colors.border} spacing={4} />
 
-                    {accounts.length > 6 ? (
+                    {graphAccounts.length > 6 ? (
                         <View style={[styles.searchBox, { backgroundColor: colors.card, borderColor: colors.border }]}>
                             <Ionicons name="search" size={16} color={colors.textSecondary} />
                             <TextInput

package/src/ui/context/OxyContext.tsx

@@ -161,42 +161,26 @@ export interface OxyContextState {
   // the caller). The cryptographic Commons/DID "identity" is a SEPARATE concept.
   //
   // UX concept: the user picks an account and the WHOLE app becomes that account
-  // — a genuine switch, NOT an "acting on behalf of" delegation. `actingAs` +
-  // `X-Acting-As` remain the underlying transport (the only one that works for
-  // passwordless org/project/bot accounts), but the framing everywhere is simply
-  // "this is the active account". Read {@link activeAccount} for "who am I"
-  // surfaces; `actingAs` is the low-level mechanism state.
-  /**
-   * The id of the account switched INTO (`X-Acting-As`), or `null` when the
-   * active account is the sign-in's own personal account. This is the underlying
-   * mechanism state — UI should present the result through {@link activeAccount}
-   * rather than framing it as delegation.
-   */
-  actingAs: string | null;
+  // — a genuine, REAL-SESSION switch (`switchToAccount`), identical to switching
+  // between device sign-ins. There is NO separate "active account" concept:
+  // `user` IS the active account after a switch. The removed `X-Acting-As`
+  // delegation header is gone entirely.
   /** Every account the caller can access — own personal root, owned, and shared — from `listAccounts()`. */
   accounts: AccountNode[];
   /**
-   * The {@link AccountNode} switched into, resolved from `accounts` by
-   * `actingAs`. `null` when the active account is the sign-in's own personal
-   * account, or while the switched-into id has not yet appeared in the loaded
-   * `accounts` list.
-   */
-  actingAsAccount: AccountNode | null;
-  /**
-   * The effective ACTIVE account presented across the whole app — the account
-   * the user switched into when one is set and resolved, otherwise the signed-in
-   * user's own personal account. This is the single "who am I" source every
-   * identity surface (header avatar/name, profile chrome, context cues) should
-   * read, so a switch is reflected everywhere as a real account change.
+   * Switch the active session INTO an account from the {@link accounts} graph
+   * (a managed org/project/bot, or an account shared with the caller).
    *
-   * It is a {@link User} (the personal user, or the switched-into account's
-   * embedded user) so every identity surface renders it identically. Falls back
-   * to the personal `user` during the brief window after a switch before
-   * `accounts` has loaded the switched-into node, so the header never flashes
-   * empty. `null` only when signed out.
+   * Mints and plants a REAL session for the target via
+   * `oxyServices.switchToAccount`, then commits it into context state the SAME
+   * way sign-in / {@link switchSession} do — so afterwards `user` IS the target
+   * account and every request authenticates as it. The minted session joins the
+   * device multi-account set (server-set httpOnly `oxy_rt_<authuser>` cookie), so
+   * it survives reload / `refresh-all` and appears in the device account list
+   * exactly like a device sign-in. Refreshes the account graph and invalidates
+   * all React Query data so everything reloads as the new account.
    */
-  activeAccount: User | null;
-  setActingAs: (accountId: string | null) => void;
+  switchToAccount: (accountId: string) => Promise<void>;
   refreshAccounts: () => Promise<void>;
   createAccount: (data: CreateAccountInput) => Promise<AccountNode>;
 }
@@ -1325,6 +1309,29 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       }
     }
 
+    // LAST-ACTIVE-ACCOUNT priority (web multi-account). When the user has an
+    // explicit persisted active slot (`oxy_active_authuser`, written on every
+    // device sign-in / account SWITCH / cookie restore), the multi-account
+    // refresh-cookie restore is the ONLY cold-boot step that honors WHICH slot
+    // was last active — `restoreViaRefreshCookie` selects it via
+    // `selectActiveRefreshAccount(accounts, readActiveAuthuser())`. The
+    // `fedcm-silent` and per-apex `silent-iframe` steps only ever recover the
+    // PRIMARY central IdP session, so if either ran first they would clobber a
+    // switched (managed/org) account back to the primary on reload — the exact
+    // "switch is lost on reload" regression. So when a slot selection exists we
+    // run cookie-restore BEFORE those probes (and disable the later duplicate).
+    //
+    // Read ONCE here (synchronously usable by the step `enabled` gates below).
+    // It is non-null ONLY on first-party `*.oxy.so` web apps that persist the
+    // slot — a cross-apex RP never writes it (its restore funnels through
+    // `handleWebSSOSession`, which does not touch the authuser), and native has
+    // no localStorage, so both keep their existing order untouched. The
+    // earlier `stored-session` step still runs first (FIX-A latency), and when
+    // a slot exists but its cookies have all lapsed, cookie-restore simply
+    // returns no accounts and the chain falls through to the cross-domain
+    // fallbacks exactly as before.
+    const prioritizeMultiAccount = isWebBrowser() && readActiveAuthuser() !== null;
+
     try {
       const outcome = await runColdBoot<true>({
         steps: [
@@ -1419,6 +1426,28 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
               return { kind: 'session', session: true };
             },
           },
+          {
+            // 2.75) LAST-ACTIVE multi-account restore (WEB, prioritized). Runs
+            // ONLY when an explicit persisted slot selection exists
+            // (`prioritizeMultiAccount`) — i.e. the user previously signed in or
+            // SWITCHED accounts on this first-party app. It runs BEFORE the
+            // `fedcm-silent` / `silent-iframe` probes (which only ever recover the
+            // PRIMARY central session) so a switched managed/org account survives
+            // reload instead of being clobbered back to the primary. The restore
+            // itself is the SAME `restoreViaRefreshCookie` as the terminal-tier
+            // step below: it rotates every device-local `oxy_rt_<authuser>` cookie
+            // and picks the persisted slot via `selectActiveRefreshAccount`,
+            // committing it (token + state + durable persistence + `markAuthResolved`).
+            // When no slot is persisted this is disabled and the original order is
+            // unchanged; when the slot's cookies have lapsed it returns no accounts
+            // and the chain falls through to the cross-domain fallbacks below.
+            id: 'cookie-restore-active',
+            enabled: () => prioritizeMultiAccount,
+            run: async () => {
+              const restored = await restoreViaRefreshCookie();
+              return restored ? { kind: 'session', session: true } : { kind: 'skip' };
+            },
+          },
           {
             // 3) FedCM silent reauthn (Chrome) against the CENTRAL IdP
             // (auth.oxy.so). `silentSignInWithFedCM` plants the access token
@@ -1493,8 +1522,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // is correct; cross-domain restore is handled by the SSO bounce.
             // FIX-D: `restoreViaRefreshCookie` bounds the request with
             // `COOKIE_RESTORE_TIMEOUT` so a cross-domain stall cannot hang here.
+            //
+            // Disabled when `prioritizeMultiAccount` already ran the
+            // `cookie-restore-active` step above (an explicit persisted slot) — that
+            // earlier step is the identical restore, so this terminal-tier copy
+            // would be a redundant second `refreshAllSessions`. It still runs in the
+            // common no-persisted-slot case (e.g. first visit to a first-party app
+            // whose central refresh cookies already exist).
             id: 'cookie-restore',
-            enabled: () => isWebBrowser(),
+            enabled: () => isWebBrowser() && !prioritizeMultiAccount,
             run: async () => {
               const restored = await restoreViaRefreshCookie();
               return restored ? { kind: 'session', session: true } : { kind: 'skip' };
@@ -2018,38 +2054,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   });
 
   // --- Account graph state ---
-  const [actingAs, setActingAsState] = useState<string | null>(null);
   const [accounts, setAccounts] = useState<AccountNode[]>([]);
 
-  // Latest `actingAs`, mirrored into a ref so `refreshAccounts` can reconcile a
-  // stale switch without taking `actingAs` as a dependency (which would re-run
-  // the account load on every switch). See the reconciliation block below.
-  const actingAsRef = useRef(actingAs);
-  actingAsRef.current = actingAs;
-  // `setActingAs` is declared after `refreshAccounts`; route the reconciliation
-  // clear through a ref so the load callback can call the latest implementation.
-  const setActingAsRef = useRef<((accountId: string | null) => void) | null>(null);
-
-  // Restore actingAs from storage on startup
-  useEffect(() => {
-    if (!storage || !initialized) return;
-    let mounted = true;
-    (async () => {
-      try {
-        const stored = await storage.getItem(`${storageKeyPrefix}_acting_as`);
-        if (mounted && stored) {
-          setActingAsState(stored);
-          oxyServices.setActingAs(stored);
-        }
-      } catch (err) {
-        if (__DEV__) {
-          loggerUtil.debug('Failed to restore actingAs from storage', { component: 'OxyContext' }, err as unknown);
-        }
-      }
-    })();
-    return () => { mounted = false; };
-  }, [storage, initialized, storageKeyPrefix, oxyServices]);
-
   // Load the unified account graph when authenticated
   const refreshAccounts = useCallback(async (): Promise<void> => {
     if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
@@ -2060,15 +2066,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     try {
       const list = await oxyServices.listAccounts();
       setAccounts(list);
-      // Reconcile a stale switch: if the active account was switched INTO an id
-      // that is no longer accessible (account removed/archived, or it belonged
-      // to a now-inactive sign-in), drop back to the personal account so the
-      // app never keeps sending a dead `X-Acting-As` header. `list` is the
-      // authoritative accessible set on a successful fetch.
-      const current = actingAsRef.current;
-      if (current && !list.some((node) => node.accountId === current)) {
-        setActingAsRef.current?.(null);
-      }
     } catch (err) {
       if (isUnauthorizedStatus(err)) {
         setAccounts([]);
@@ -2087,47 +2084,64 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
   }, [isAuthenticated, initialized, tokenReady, refreshAccounts]);
 
-  const setActingAs = useCallback((accountId: string | null) => {
-    oxyServices.setActingAs(accountId);
-    setActingAsState(accountId);
-    // Switching the acting-as identity changes every server response, but React
-    // Query keys are not namespaced by the acting-as target, so the cache would
-    // otherwise keep serving the previous account's data. Invalidate everything
-    // so each query refetches under the new identity (the next request carries
-    // the updated `X-Acting-As` header). `invalidateQueries` (not `clear`) keeps
-    // the account list/switcher populated mid-switch instead of blanking out.
-    queryClient.invalidateQueries();
-    // Persist to storage
-    if (storage) {
-      if (accountId) {
-        storage.setItem(`${storageKeyPrefix}_acting_as`, accountId).catch((persistError) => {
-          loggerUtil.debug('Failed to persist acting-as account', { component: 'OxyContext' }, persistError as unknown);
-        });
-      } else {
-        storage.removeItem(`${storageKeyPrefix}_acting_as`).catch((persistError) => {
-          loggerUtil.debug('Failed to clear acting-as account', { component: 'OxyContext' }, persistError as unknown);
-        });
+  // Switch the active session INTO an account from the unified graph. In the
+  // REAL-SESSION model this is identical to switching device sign-ins: mint a
+  // real session for the target and make the whole app that account. The removed
+  // `X-Acting-As` delegation header is gone — `oxyServices.switchToAccount`
+  // plants the minted access token (the refresh token is the server-set httpOnly
+  // `oxy_rt_<authuser>` cookie, so the session joins the device multi-account set
+  // and survives reload / `refresh-all`). We then commit the session into context
+  // state the SAME way sign-in / `switchSession` do, refresh the account graph,
+  // and invalidate every query so all data reloads as the new account.
+  const switchToAccount = useCallback(async (accountId: string): Promise<void> => {
+    const result = await oxyServices.switchToAccount(accountId);
+    if (!result?.user || !result?.sessionId) {
+      throw new Error('Account switch did not return a valid session');
+    }
+
+    // `oxyServices.switchToAccount` already planted `result.accessToken` as the
+    // active token; mirror the minted session into the multi-account store and
+    // mark it current, recording the device `authuser` slot so web silent-switch
+    // and the device account chooser can address it.
+    const now = new Date();
+    const clientSession: ClientSession = {
+      sessionId: result.sessionId,
+      deviceId: result.deviceId || '',
+      expiresAt: result.expiresAt || new Date(now.getTime() + DEFAULT_SESSION_VALIDITY_MS).toISOString(),
+      lastActive: now.toISOString(),
+      userId: result.user.id?.toString() ?? '',
+      isCurrent: true,
+      ...(typeof result.authuser === 'number' ? { authuser: result.authuser } : null),
+    };
+    updateSessions([clientSession], { merge: true });
+    setActiveSessionId(result.sessionId);
+    if (isWebBrowser() && typeof result.authuser === 'number') {
+      writeActiveAuthuser(result.authuser);
+    }
+    await persistSessionDurably(result.sessionId);
+
+    // Fetch the canonical User for the new account (the switch result carries
+    // only MinimalUserData); fall back to that minimal shape if the profile
+    // fetch fails so the app still reflects the switched identity.
+    let fullUser: User;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user after account switch; using switch result user', { component: 'OxyContext', method: 'switchToAccount' }, profileError as unknown);
       }
+      fullUser = result.user as unknown as User;
     }
-  }, [oxyServices, storage, storageKeyPrefix, queryClient]);
-  setActingAsRef.current = setActingAs;
-
-  // The account switched into, resolved from the loaded graph.
-  const actingAsAccount = useMemo<AccountNode | null>(() => {
-    if (!actingAs) return null;
-    return accounts.find((node) => node.accountId === actingAs) ?? null;
-  }, [actingAs, accounts]);
-
-  // The effective ACTIVE account presented across the app: the switched-into
-  // account's user when a switch is set and resolved, otherwise the signed-in
-  // user's own personal account. Derived (no effect) so identity surfaces always
-  // render the current account without separate syncing. Falls back to `user`
-  // while a just-set switch has not yet resolved in `accounts`, so the header
-  // never flashes empty mid-switch.
-  const activeAccount = useMemo<User | null>(
-    () => (actingAs && actingAsAccount ? actingAsAccount.account : user),
-    [actingAs, actingAsAccount, user],
-  );
+    loginSuccess(fullUser);
+    onAuthStateChange?.(fullUser);
+
+    // Reload the switchable account graph (the new active account's relationships
+    // differ) and invalidate every query so all data refetches as the new
+    // account — the deviceAccounts probe re-enumerates the multi-account set so
+    // the switched account now appears as a device session.
+    await refreshAccounts();
+    queryClient.invalidateQueries();
+  }, [oxyServices, updateSessions, setActiveSessionId, persistSessionDurably, loginSuccess, onAuthStateChange, refreshAccounts, queryClient]);
 
   const createAccountFn = useCallback(async (data: CreateAccountInput): Promise<AccountNode> => {
     const account = await oxyServices.createAccount(data);
@@ -2177,11 +2191,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     useFollow: useFollowHook,
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn,
   }), [
@@ -2224,11 +2235,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     user,
     showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccountFn,
   ]);
@@ -2297,11 +2305,8 @@ const LOADING_STATE: OxyContextState = {
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
   openAvatarPicker: () => {},
-  actingAs: null,
   accounts: [],
-  actingAsAccount: null,
-  activeAccount: null,
-  setActingAs: () => {},
+  switchToAccount: () => rejectMissingProvider<void>(),
   refreshAccounts: () => rejectMissingProvider<void>(),
   createAccount: () => rejectMissingProvider<AccountNode>(),
 };

package/src/ui/hooks/queries/useAccountQueries.ts

@@ -232,11 +232,11 @@ export const useAuthorizedApps = (options?: { enabled?: boolean }) => {
  * Get privacy settings for a user
  */
 export const usePrivacySettings = (userId?: string, options?: { enabled?: boolean }) => {
-  const { oxyServices, activeSessionId, activeAccount } = useOxy();
+  const { oxyServices, activeSessionId, user } = useOxy();
   // When no explicit user id is supplied, target the ACTIVE account (the
   // account switched into) so "my privacy settings" reflects the current
   // account, matching the imperative PrivacySettingsScreen.
-  const targetUserId = userId || activeAccount?.id;
+  const targetUserId = userId || user?.id;
 
   return useQuery({
     queryKey: queryKeys.privacy.settings(targetUserId),