@shipfox/client-auth 5.0.0 → 6.0.2

package/src/hooks/api/verify-email-auth.ts

@@ -1,31 +1,41 @@
 import {
-  type VerifyEmailConfirmBodyDto,
-  type VerifyEmailResendBodyDto,
   verifyEmailConfirmResponseSchema,
   verifyEmailResendResponseSchema,
 } from '@shipfox/api-auth-dto';
 import {checkedApiRequest} from '@shipfox/client-api';
 import {useMutation} from '@tanstack/react-query';
+import type {
+  EmailVerificationResendResult,
+  ResendEmailVerificationCommand,
+  VerifyEmailCommand,
+} from '#core/auth.js';
 import {useAuthTransition} from '#state/auth.js';
 import {toAuthenticatedSession} from './auth-mapper.js';
 
-async function verifyEmailAuth(body: VerifyEmailConfirmBodyDto) {
+async function verifyEmailAuth(command: VerifyEmailCommand) {
   const response = await checkedApiRequest(
     verifyEmailConfirmResponseSchema,
     '/auth/verify-email/confirm',
     {
       method: 'POST',
-      body,
+      body: {email: command.email, challenge_id: command.challengeId, code: command.code},
     },
   );
   return toAuthenticatedSession(response);
 }
 
-async function resendEmailVerificationAuth(body: VerifyEmailResendBodyDto) {
-  return await checkedApiRequest(verifyEmailResendResponseSchema, '/auth/verify-email/resend', {
-    method: 'POST',
-    body,
-  });
+async function resendEmailVerificationAuth(command: ResendEmailVerificationCommand) {
+  const response = await checkedApiRequest(
+    verifyEmailResendResponseSchema,
+    '/auth/verify-email/resend',
+    {
+      method: 'POST',
+      body: {email: command.email, challenge_id: command.challengeId},
+    },
+  );
+  return {
+    nextResendAvailableAt: response.next_resend_available_at,
+  } satisfies EmailVerificationResendResult;
 }
 
 export function useResendEmailVerificationAuth() {
@@ -37,6 +47,6 @@ export function useVerifyEmailAuth() {
 
   return useMutation({
     mutationFn: verifyEmailAuth,
-    onSuccess: enterAuthenticated,
+    onSuccess: (session) => enterAuthenticated(session),
   });
 }

package/src/hooks/api/workspace-auth.ts

@@ -1,19 +1,24 @@
-import {type CreateWorkspaceBodyDto, workspaceResponseSchema} from '@shipfox/api-workspaces-dto';
+import {workspaceResponseSchema} from '@shipfox/api-workspaces-dto';
 import {checkedApiRequest} from '@shipfox/client-api';
-import {listUserWorkspaces, userWorkspacesQueryKey} from '@shipfox/client-shell/runtime';
+import {
+  listUserWorkspaces,
+  userWorkspacesQueryKey,
+  userWorkspacesQueryOptions,
+} from '@shipfox/client-shell/runtime';
 import {useMutation} from '@tanstack/react-query';
+import type {WorkspaceCreateCommand} from '#core/auth.js';
 import {useRefreshAuth} from './refresh-auth.js';
 import {toWorkspace} from './workspace-mapper.js';
 
-export async function createWorkspace(body: CreateWorkspaceBodyDto) {
+export async function createWorkspace(command: WorkspaceCreateCommand) {
   const response = await checkedApiRequest(workspaceResponseSchema, '/workspaces', {
     method: 'POST',
-    body,
+    body: {name: command.name},
   });
   return toWorkspace(response);
 }
 
-export {listUserWorkspaces, userWorkspacesQueryKey};
+export {listUserWorkspaces, userWorkspacesQueryKey, userWorkspacesQueryOptions};
 
 export function useCreateWorkspaceAuth() {
   const refreshAuth = useRefreshAuth();

package/src/hooks/api/workspace-mapper.ts

@@ -1,10 +1,5 @@
 import type {WorkspaceResponseDto} from '@shipfox/api-workspaces-dto';
-
-export interface Workspace {
-  id: string;
-  name: string;
-  status: 'active' | 'suspended' | 'deleted';
-}
+import type {Workspace} from '#core/auth.js';
 
 export function toWorkspace(dto: WorkspaceResponseDto): Workspace {
   return {id: dto.id, name: dto.name, status: dto.status};

package/src/pages/login-page.tsx

@@ -1,16 +1,17 @@
 import {loginBodySchema} from '@shipfox/api-auth-dto';
-import {AuthShell} from '@shipfox/client-shell/runtime';
+import {AuthShell, useRouteSearch} from '@shipfox/client-shell/runtime';
 import {Button, ButtonLink} from '@shipfox/react-ui/button';
 import {Callout} from '@shipfox/react-ui/callout';
 import {FormField, FormFieldInput, fieldError} from '@shipfox/react-ui/form-field';
 import {Icon} from '@shipfox/react-ui/icon';
 import {Text} from '@shipfox/react-ui/typography';
 import {useForm} from '@tanstack/react-form';
-import {Link, useSearch} from '@tanstack/react-router';
+import {Link} from '@tanstack/react-router';
 import {useAtom} from 'jotai';
 import {useEffect, useRef, useState} from 'react';
 import {useLoginAuth} from '#hooks/api/login-auth.js';
 import {authFormDraftAtom, initialAuthFormDraft} from '#state/auth.js';
+import {validateRedirectSearch} from '../routes/inputs.js';
 import {loginErrorToFormError} from './form-errors.js';
 import {
   extractInvitationToken,
@@ -20,7 +21,7 @@ import {
 
 export function LoginPage() {
   const login = useLoginAuth();
-  const search = useSearch({strict: false}) as {redirect?: unknown};
+  const search = useRouteSearch(validateRedirectSearch);
   const invitationToken = extractInvitationToken(search.redirect);
   const invitationPreview = useInvitationContext(invitationToken);
   const invitationPending = pendingInvitation(invitationPreview.data);

package/src/pages/logout-page.test.tsx

@@ -0,0 +1,75 @@
+import {configureApiClient} from '@shipfox/client-api';
+import {AuthRuntime} from '@shipfox/client-shell/runtime';
+import {QueryClient, QueryClientProvider} from '@tanstack/react-query';
+import {
+  createMemoryHistory,
+  createRootRoute,
+  createRoute,
+  createRouter,
+  Outlet,
+  RouterProvider,
+} from '@tanstack/react-router';
+import {render, screen} from '@testing-library/react';
+import {Provider as JotaiProvider} from 'jotai';
+import {LogoutPage} from './logout-page.js';
+
+function renderLogoutPage(path: string) {
+  const rootRoute = createRootRoute({component: Outlet});
+  const logoutRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: '/auth/logout',
+    component: LogoutPage,
+  });
+  const loginRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: '/auth/login',
+    component: () => <h1>Login destination</h1>,
+  });
+  const workspaceRoute = createRoute({
+    getParentRoute: () => rootRoute,
+    path: '/workspaces/$wid',
+    component: () => <h1>Workspace destination</h1>,
+  });
+  const router = createRouter({
+    history: createMemoryHistory({initialEntries: [path]}),
+    routeTree: rootRoute.addChildren([logoutRoute, loginRoute, workspaceRoute]),
+  });
+  const queryClient = new QueryClient();
+
+  render(
+    <QueryClientProvider client={queryClient}>
+      <JotaiProvider>
+        <AuthRuntime effects={false}>
+          <RouterProvider router={router} />
+        </AuthRuntime>
+      </JotaiProvider>
+    </QueryClientProvider>,
+  );
+}
+
+describe('LogoutPage', () => {
+  beforeEach(() => {
+    configureApiClient({baseUrl: 'https://api.example.test', getAccessToken: undefined});
+  });
+
+  test('logs out before following a safe same-origin redirect', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(new Response(null, {status: 204}));
+    configureApiClient({fetchImpl});
+
+    renderLogoutPage('/auth/logout?redirect=%2Fworkspaces%2Facme');
+
+    expect(await screen.findByRole('heading', {name: 'Workspace destination'})).toBeVisible();
+    const request = fetchImpl.mock.calls[0]?.[0] as Request;
+    expect(request.url).toBe('https://api.example.test/auth/logout');
+    expect(request.method).toBe('POST');
+  });
+
+  test('falls back to login without forwarding an invitation token', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(new Response(null, {status: 204}));
+    configureApiClient({fetchImpl});
+
+    renderLogoutPage('/auth/logout?redirect=%2Finvitations%2Faccept%3Ftoken%3Dsf_i_raw-token');
+
+    expect(await screen.findByRole('heading', {name: 'Login destination'})).toBeVisible();
+  });
+});

package/src/pages/logout-page.tsx

@@ -1,27 +1,23 @@
-import {AuthShell} from '@shipfox/client-shell/runtime';
+import {AuthShell, useRouteSearch} from '@shipfox/client-shell/runtime';
 import {Text} from '@shipfox/react-ui/typography';
-import {useNavigate, useRouter, useSearch} from '@tanstack/react-router';
+import {useRouter} from '@tanstack/react-router';
 import {useEffect} from 'react';
-import {sanitizeRedirectPath} from '#/components/redirect-target.js';
+import {sanitizeLogoutRedirectPath} from '#/components/redirect-target.js';
 import {useLogoutAuth} from '#hooks/api/logout-auth.js';
+import {validateRedirectSearch} from '../routes/inputs.js';
 
 export function LogoutPage() {
   const logout = useLogoutAuth();
-  const navigate = useNavigate();
   const router = useRouter();
-  const search = useSearch({strict: false}) as {redirect?: unknown};
-  const target = sanitizeRedirectPath(search.redirect);
+  const search = useRouteSearch(validateRedirectSearch);
+  const target = sanitizeLogoutRedirectPath(search.redirect);
 
   useEffect(() => {
     logout.mutateAsync().finally(() => {
-      if (target !== undefined) {
-        // Same-origin runtime path; let history drive route resolution.
-        router.history.replace(target);
-      } else {
-        navigate({to: '/auth/login', replace: true});
-      }
+      // Same-origin runtime path; let history drive route resolution.
+      router.history.replace(target);
     });
-  }, [logout.mutateAsync, navigate, router, target]);
+  }, [logout.mutateAsync, router, target]);
 
   return (
     <AuthShell title="Logging out" description="Ending your Shipfox session.">

package/src/pages/password-reset-page.tsx

@@ -2,14 +2,14 @@ import {
   passwordResetConfirmBodySchema,
   passwordResetRequestBodySchema,
 } from '@shipfox/api-auth-dto';
-import {AuthShell} from '@shipfox/client-shell/runtime';
+import {AuthShell, useRouteSearch} from '@shipfox/client-shell/runtime';
 import {Button, ButtonLink} from '@shipfox/react-ui/button';
 import {Callout} from '@shipfox/react-ui/callout';
 import {FormField, FormFieldInput, fieldError} from '@shipfox/react-ui/form-field';
 import {toast} from '@shipfox/react-ui/toast';
 import {Text} from '@shipfox/react-ui/typography';
 import {useForm} from '@tanstack/react-form';
-import {Link, useNavigate, useSearch} from '@tanstack/react-router';
+import {Link, useNavigate} from '@tanstack/react-router';
 import {useAtom} from 'jotai';
 import {useEffect, useRef, useState} from 'react';
 import {
@@ -17,14 +17,14 @@ import {
   useRequestPasswordResetAuth,
 } from '#hooks/api/password-reset-auth.js';
 import {authFormDraftAtom, initialAuthFormDraft} from '#state/auth.js';
+import {validatePasswordResetSearch} from '../routes/inputs.js';
 import {
   passwordResetConfirmErrorToFormError,
   passwordResetRequestErrorToFormError,
 } from './form-errors.js';
 
 export function PasswordResetPage() {
-  const search = useSearch({strict: false});
-  const token = typeof search.token === 'string' ? search.token : undefined;
+  const {token} = useRouteSearch(validatePasswordResetSearch);
 
   if (token) {
     return <PasswordResetConfirm token={token} />;
@@ -160,7 +160,7 @@ function PasswordResetConfirm({token}: {token: string}) {
           token,
           new_password: value.new_password,
         });
-        await confirmPasswordReset.mutateAsync(body);
+        await confirmPasswordReset.mutateAsync({token: body.token, newPassword: body.new_password});
         setAuthFormDraft(initialAuthFormDraft);
         toast.success('Your password has been changed. You are now logged in.');
         await navigate({to: '/', replace: true});

package/src/pages/signup-page.tsx

@@ -1,5 +1,5 @@
 import {signupBodySchema} from '@shipfox/api-auth-dto';
-import {AuthShell} from '@shipfox/client-shell/runtime';
+import {AuthShell, useRouteSearch} from '@shipfox/client-shell/runtime';
 import {displayNameFieldError} from '@shipfox/client-ui';
 import {Button, ButtonLink} from '@shipfox/react-ui/button';
 import {Callout} from '@shipfox/react-ui/callout';
@@ -8,7 +8,7 @@ import {Icon} from '@shipfox/react-ui/icon';
 import {toast} from '@shipfox/react-ui/toast';
 import {Text} from '@shipfox/react-ui/typography';
 import {useForm} from '@tanstack/react-form';
-import {Link, useNavigate, useSearch} from '@tanstack/react-router';
+import {Link, useNavigate} from '@tanstack/react-router';
 import {useAtom} from 'jotai';
 import {useEffect, useRef, useState} from 'react';
 import {EmailCodeVerification} from '#/components/email-code-verification.js';
@@ -16,6 +16,7 @@ import {useRefreshAuth} from '#hooks/api/refresh-auth.js';
 import {useSignupAuth} from '#hooks/api/signup-auth.js';
 import {useResendEmailVerificationAuth, useVerifyEmailAuth} from '#hooks/api/verify-email-auth.js';
 import {authFormDraftAtom, initialAuthFormDraft} from '#state/auth.js';
+import {validateRedirectSearch} from '../routes/inputs.js';
 import {signupErrorToFormError} from './form-errors.js';
 import {authErrorMessage} from './form-utils.js';
 import {
@@ -30,7 +31,7 @@ export function SignupPage() {
   const resendEmailVerification = useResendEmailVerificationAuth();
   const refreshAuth = useRefreshAuth();
   const navigate = useNavigate();
-  const search = useSearch({strict: false}) as {redirect?: unknown};
+  const search = useRouteSearch(validateRedirectSearch);
   const invitationToken = extractInvitationToken(search.redirect);
   const invitationPreview = useInvitationContext(invitationToken);
   const invitationPending = pendingInvitation(invitationPreview.data);
@@ -50,13 +51,18 @@ export function SignupPage() {
     onSubmit: async ({value}) => {
       setFormError(undefined);
       try {
-        const body = signupBodySchema.parse({
+        const parsed = signupBodySchema.parse({
           email: value.email,
           password: value.password,
           name: value.name,
           ...(invitationToken ? {invitation_token: invitationToken} : {}),
         });
-        const result = await signup.mutateAsync(body);
+        const result = await signup.mutateAsync({
+          email: parsed.email,
+          password: parsed.password,
+          name: parsed.name,
+          ...(parsed.invitation_token ? {invitationToken: parsed.invitation_token} : {}),
+        });
         skipDraftPersistRef.current = true;
         setAuthFormDraft(initialAuthFormDraft);
 
@@ -132,9 +138,9 @@ export function SignupPage() {
     try {
       const result = await resendEmailVerification.mutateAsync({
         email: emailChallenge.email,
-        challenge_id: emailChallenge.id,
+        challengeId: emailChallenge.id,
       });
-      setNextResendAvailableAt(result.next_resend_available_at);
+      setNextResendAvailableAt(result.nextResendAvailableAt);
       toast.success('If another verification email can be sent, it will arrive shortly.');
     } catch (error) {
       setResendError(authErrorMessage(error));
@@ -154,7 +160,7 @@ export function SignupPage() {
           try {
             await verifyEmail.mutateAsync({
               email: emailChallenge.email,
-              challenge_id: emailChallenge.id,
+              challengeId: emailChallenge.id,
               code,
             });
             await refreshAuth();

package/src/pages/workspace-onboarding-page.tsx

@@ -12,7 +12,8 @@ import {useNavigate} from '@tanstack/react-router';
 import {useSetAtom} from 'jotai';
 import {useState} from 'react';
 import {useCreateWorkspaceAuth} from '#hooks/api/workspace-auth.js';
-import {lastWorkspaceIdAtom} from '#state/last-workspace.js';
+import {useAuthState} from '#hooks/use-auth-state.js';
+import {lastWorkspaceIdAtom, rememberLastWorkspaceId} from '#state/last-workspace.js';
 import {workspaceOnboardingErrorToFormError} from './form-errors.js';
 
 const previewMetrics = [
@@ -34,6 +35,7 @@ const previewBars = [
 
 export function WorkspaceOnboardingPage() {
   const createWorkspace = useCreateWorkspaceAuth();
+  const {user} = useAuthState();
   const navigate = useNavigate();
   const setLastWorkspaceId = useSetAtom(lastWorkspaceIdAtom);
   const [formError, setFormError] = useState<string | undefined>();
@@ -43,13 +45,14 @@ export function WorkspaceOnboardingPage() {
     onSubmit: async ({value}) => {
       setFormError(undefined);
       try {
-        const body = createWorkspaceBodySchema.parse({name: value.name});
-        const created = await createWorkspace.mutateAsync(body);
+        const command = createWorkspaceBodySchema.parse({name: value.name});
+        const created = await createWorkspace.mutateAsync(command);
         toast.success('Workspace created.');
         // Pin the new workspace as the last-active one so a page refresh and
         // future visits to `/` land on it.
         try {
           setLastWorkspaceId(created.id);
+          if (user?.id) rememberLastWorkspaceId(user.id, created.id);
         } catch {
           // localStorage may throw in private browsing or quota-exceeded.
         }

package/src/routes/index.tsx

@@ -10,9 +10,11 @@ export default defineRoute({
     if (!auth.isAuthenticated) throw redirect({to: '/auth/login'});
     const [first, ...rest] = auth.workspaces;
     if (!first) throw redirect({to: '/setup/workspaces/new'});
-    const target =
-      [first, ...rest].find((workspace) => workspace.id === getLastWorkspaceId()) ?? first;
-    throw redirect({to: '/workspaces/$wid', params: {wid: target.id}});
+    const principalId = auth.user?.id;
+    const target = principalId
+      ? [first, ...rest].find((workspace) => workspace.id === getLastWorkspaceId(principalId))
+      : undefined;
+    throw redirect({to: '/workspaces/$wid', params: {wid: (target ?? first).id}});
   },
   component: FullPageLoader,
 });

package/src/routes/inputs.test.ts

@@ -0,0 +1,17 @@
+import {validatePasswordResetSearch, validateRedirectSearch} from './inputs.js';
+
+describe('auth route inputs', () => {
+  it('keeps only a non-empty redirect', () => {
+    expect(validateRedirectSearch({redirect: '/workspaces/w-1'})).toEqual({
+      redirect: '/workspaces/w-1',
+    });
+    expect(validateRedirectSearch({redirect: ''})).toEqual({});
+    expect(validateRedirectSearch({redirect: ['unexpected']})).toEqual({});
+  });
+
+  it('keeps only a non-empty password reset token', () => {
+    expect(validatePasswordResetSearch({token: 'reset-token'})).toEqual({token: 'reset-token'});
+    expect(validatePasswordResetSearch({token: ''})).toEqual({});
+    expect(validatePasswordResetSearch({token: {value: 'unexpected'}})).toEqual({});
+  });
+});

package/src/routes/inputs.ts

@@ -0,0 +1,21 @@
+export interface AuthRedirectSearch {
+  redirect?: string;
+}
+
+export interface PasswordResetSearch {
+  token?: string;
+}
+
+export function validateRedirectSearch(input: Record<string, unknown>): AuthRedirectSearch {
+  const redirect = nonEmptyString(input.redirect);
+  return redirect ? {redirect} : {};
+}
+
+export function validatePasswordResetSearch(input: Record<string, unknown>): PasswordResetSearch {
+  const token = nonEmptyString(input.token);
+  return token ? {token} : {};
+}
+
+function nonEmptyString(value: unknown): string | undefined {
+  return typeof value === 'string' && value.length > 0 ? value : undefined;
+}

package/src/routes/login.tsx

@@ -1,8 +1,10 @@
 import {defineRoute} from '@shipfox/client-shell/runtime';
 import {GuestGuard} from '#components/auth-guard.js';
 import {LoginPage} from '#pages/login-page.js';
+import {validateRedirectSearch} from './inputs.js';
 
 export default defineRoute({
+  validateSearch: validateRedirectSearch,
   component: () => (
     <GuestGuard>
       <LoginPage />

package/src/routes/logout.tsx

@@ -1,4 +1,5 @@
 import {defineRoute} from '@shipfox/client-shell/runtime';
 import {LogoutPage} from '#pages/logout-page.js';
+import {validateRedirectSearch} from './inputs.js';
 
-export default defineRoute({component: LogoutPage});
+export default defineRoute({validateSearch: validateRedirectSearch, component: LogoutPage});

package/src/routes/reset.tsx

@@ -1,8 +1,10 @@
 import {defineRoute} from '@shipfox/client-shell/runtime';
 import {GuestGuard} from '#components/auth-guard.js';
 import {PasswordResetPage} from '#pages/password-reset-page.js';
+import {validatePasswordResetSearch} from './inputs.js';
 
 export default defineRoute({
+  validateSearch: validatePasswordResetSearch,
   component: () => (
     <GuestGuard>
       <PasswordResetPage />

package/src/routes/signup.tsx

@@ -1,8 +1,10 @@
 import {defineRoute} from '@shipfox/client-shell/runtime';
 import {GuestGuard} from '#components/auth-guard.js';
 import {SignupPage} from '#pages/signup-page.js';
+import {validateRedirectSearch} from './inputs.js';
 
 export default defineRoute({
+  validateSearch: validateRedirectSearch,
   component: () => (
     <GuestGuard>
       <SignupPage />

package/src/state/last-workspace.test.ts

@@ -5,7 +5,7 @@ import {
   rememberLastWorkspaceId,
 } from './last-workspace.js';
 
-describe('lastWorkspaceIdAtom', () => {
+describe('last workspace state', () => {
   beforeEach(() => {
     window.localStorage.clear();
   });
@@ -14,21 +14,13 @@ describe('lastWorkspaceIdAtom', () => {
     window.localStorage.clear();
   });
 
-  test('initial value is undefined when storage is empty', () => {
-    const store = createStore();
-
-    expect(store.get(lastWorkspaceIdAtom)).toBeUndefined();
-  });
-
-  test('write persists to localStorage and round-trips through the atom', () => {
+  test('atom stores current UI selection without unscoped persistence', () => {
     const store = createStore();
 
     store.set(lastWorkspaceIdAtom, 'workspace-1');
 
-    expect(JSON.parse(window.localStorage.getItem('shipfox.lastWorkspaceId') ?? 'null')).toBe(
-      'workspace-1',
-    );
     expect(store.get(lastWorkspaceIdAtom)).toBe('workspace-1');
+    expect(window.localStorage.getItem('shipfox.lastWorkspaceId')).toBeNull();
   });
 
   test('subscribers receive updates when the atom is set', () => {
@@ -45,34 +37,35 @@ describe('lastWorkspaceIdAtom', () => {
     unsubscribe();
   });
 
-  test('syncs the atom when another tab updates last workspace storage', () => {
-    const store = createStore();
-    const unsubscribe = store.sub(lastWorkspaceIdAtom, () => undefined);
-    window.localStorage.setItem('shipfox.lastWorkspaceId', JSON.stringify('workspace-2'));
-
-    window.dispatchEvent(
-      new StorageEvent('storage', {
-        key: 'shipfox.lastWorkspaceId',
-        storageArea: window.localStorage,
-      }),
-    );
+  test('write persists to localStorage and can be read for the same principal', () => {
+    rememberLastWorkspaceId('principal-1', 'workspace-1');
 
-    expect(store.get(lastWorkspaceIdAtom)).toBe('workspace-2');
-    unsubscribe();
+    expect(
+      JSON.parse(
+        window.localStorage.getItem('shipfox.lastWorkspaceId.principal.principal-1') ?? 'null',
+      ),
+    ).toBe('workspace-1');
+    expect(getLastWorkspaceId('principal-1')).toBe('workspace-1');
   });
 
   test('rememberLastWorkspaceId persists a root redirect target', () => {
-    rememberLastWorkspaceId('workspace-1');
+    rememberLastWorkspaceId('principal-1', 'workspace-1');
 
-    const result = getLastWorkspaceId();
+    const result = getLastWorkspaceId('principal-1');
 
     expect(result).toBe('workspace-1');
   });
 
+  test("does not reuse a different principal's root redirect target", () => {
+    rememberLastWorkspaceId('principal-a', 'workspace-a');
+
+    expect(getLastWorkspaceId('principal-b')).toBeUndefined();
+  });
+
   test('getLastWorkspaceId ignores malformed storage', () => {
-    window.localStorage.setItem('shipfox.lastWorkspaceId', '{');
+    window.localStorage.setItem('shipfox.lastWorkspaceId.principal.principal-1', '{');
 
-    const result = getLastWorkspaceId();
+    const result = getLastWorkspaceId('principal-1');
 
     expect(result).toBeUndefined();
   });