portal-mojo 0.2.8 → 0.2.9

package/src/client/action-result.ts

@@ -4,63 +4,24 @@
 //
 // The wire (verified against django-mojo rest.py + consumer measurement,
 // wmx-admin-v2 annex): an action handler's return dict reaches the client in
-// one of two shapes —
+// one of two shapes, always inside an HTTP 200 —
 //   flat      {success: false, code, error, ...}            (JsonResponse verbatim)
 //   wrapped   {status: true, data: {success: false, ...}}   (save-and-respond)
-// — always inside an HTTP 200, so the transport's unwrap does NOT reject.
-// One oddball spells the flag `status` instead of `success` inside the
-// action payload (`revoke_sessions`); envelope-level `status: false` is a
-// different thing entirely and already rejects in unwrap. One-shot secrets
-// differ by direction: top-level on create, inside the action payload on
-// rotate — `payload` below merges both so callers read one place.
+// unwrap rejects the FLAT shape for every call (#5922); a wrapped
+// `success:false` can be ordinary data on a successful POST, so only this
+// layer, which knows it posted an action, reads it as a refusal. One oddball
+// spells the flag `status` instead of `success` inside the action payload
+// (`revoke_sessions`); envelope-level `status: false` is a different thing
+// entirely and already rejects in unwrap. One-shot secrets differ by
+// direction: top-level on create, inside the action payload on rotate —
+// `payload` merges both so callers read one place. The reader and the error
+// live in errors.ts (cycle-free, so unwrap can use them) and are re-exported
+// here unchanged.
 import { mojoCall } from './client';
 import { withFreshAuth } from './auth';
-import { MojoError } from './errors';
-import { getActiveGroupId } from './active-group';
-import { endpointScopeFor, endpointScopeValue } from './endpoint-scope';
+import { ActionRefusedError, readActionResult, type ActionResult } from './errors';
 
-export interface ActionResult {
-    /** False when the handler refused inside the 200. */
-    ok: boolean;
-    /** Semantic refusal code (`WRONG_STATUS`, `MISSING_DETAILS`, …). */
-    code?: string;
-    /** Server-provided human error text. */
-    error?: string;
-    /** Envelope ⊕ action dict (action fields win) — one-shot secrets,
-     *  counts etc. read from here regardless of wire shape. */
-    payload: Record<string, unknown>;
-}
-
-export function readActionResult(out: unknown): ActionResult {
-    const env = (typeof out === 'object' && out !== null ? out : {}) as Record<string, unknown>;
-    const data = (typeof env.data === 'object' && env.data !== null ? env.data : {}) as Record<string, unknown>;
-    const payload = { ...env, ...data };
-    const refused = env.success === false
-        || data.success === false
-        || data.status === false; // the `status`-spelling oddball (revoke_sessions)
-    const code = typeof payload.code === 'string' && payload.code ? payload.code : undefined;
-    const error = typeof payload.error === 'string' && payload.error ? payload.error : undefined;
-    return { ok: !refused, code, error, payload };
-}
-
-/**
- * A refused action. `status` is 200 on purpose — the HTTP layer succeeded;
- * the HANDLER said no. `errorCode` carries the refusal code, `data` the
- * merged payload (may hold evidence like the current row status).
- */
-export class ActionRefusedError extends MojoError {
-    result: ActionResult;
-    constructor(action: string, result: ActionResult) {
-        super(
-            result.error ?? (result.code ? `${action} refused (${result.code})` : `${action} was refused by the server`),
-            200,
-            result.code,
-            result.payload,
-        );
-        this.name = 'ActionRefusedError';
-        this.result = result;
-    }
-}
+export { readActionResult, ActionRefusedError, type ActionResult } from './errors';
 
 /**
  * The raw-path action primitive: POST `{[action]: payload}` to
@@ -69,6 +30,11 @@ export class ActionRefusedError extends MojoError {
  * send `true` (django-mojo dispatches on the key's presence; handlers
  * treat a non-dict value as flag-only).
  *
+ * Sends NO scope key, on any family (#5923): this is a REST record route, so
+ * the server binds the row's own group, and a `group` in the body would be
+ * saved as the row's `group` field. The call is declared `unscoped: true`, so
+ * a registered-required family does not trip the dev tripwire.
+ *
  * For model-bound calls prefer `defineModel(...).useAction` — it rides the
  * same normalizer and additionally maintains the record caches.
  */
@@ -78,16 +44,12 @@ export async function mojoAction(
     action: string,
     payload?: unknown,
 ): Promise<ActionResult> {
-    // Scope-registered families (endpoint-scope.ts, #1936) get the group
-    // injected into the action body — the wallet-verbs class: actions the
-    // backend refuses for brand-scoped operators without it.
-    const path = `${endpoint}/${id}`;
-    const reg = endpointScopeFor(path);
-    const gid = reg ? getActiveGroupId() : null;
-    const scope = reg && gid != null ? { [reg.key]: endpointScopeValue(reg, gid) } : {};
-    const body = await withFreshAuth(() => mojoCall(path, {
+    const body = await withFreshAuth(() => mojoCall(`${endpoint}/${id}`, {
         method: 'POST',
-        body: { ...scope, [action]: payload ?? true },
+        body: { [action]: payload ?? true },
+        unscoped: true,
+        // Read the refusal here, so the error names the action, not the path.
+        refusal: 'return',
     }));
     const result = readActionResult(body);
     if (!result.ok) throw new ActionRefusedError(action, result);

package/src/client/active-group.ts

@@ -1,13 +1,19 @@
 // Active-group signal — GroupProvider OWNS the active group (context stays
 // the React-side source of truth); this cell mirrors it so plain functions
-// (mojoRpc, mojoScopedCall, mojoAction's scope injection) can resolve the
-// current scope without threading an id through every call site. Same
-// subscribable-module-state idiom as ui/active-persona.ts (#1609).
+// (mojoRpc, mojoScopedCall) can resolve the current scope without threading
+// an id through every call site. Same subscribable-module-state idiom as
+// ui/active-persona.ts (#1609).
 //
 // Do NOT read localStorage's `active_group_id` here instead — the URL
 // `?group=` param BEATS the stored id (group.tsx resolution order), and only
 // the provider computes that. The signal is written from the provider's
 // activation path, so it always reflects the resolved truth.
+//
+// The provider writes it in the LAYOUT phase (#5918), so anything that reads
+// it from a passive effect — every TanStack Query fetch — sees the committed
+// group. A child's own layout effect, or a fetch started during render
+// (suspense queries), runs earlier and still sees the previous one: pass
+// `group` explicitly there.
 
 let activeGroupId: number | null = null;
 const listeners = new Set<() => void>();

package/src/client/auth.ts

@@ -198,16 +198,23 @@ async function doRefresh(): Promise<boolean> {
         return false;
     }
     const persistent = sessionIsPersistent();
+    // The answer is for the session whose refresh token was sent. When the
+    // stored one is no longer that token, the session was replaced while this
+    // was in flight: a save that changed the password (tokensReplaced), a new
+    // sign-in, a sign-out. A late pair is signed with a key the server has
+    // dropped, and a late 401 is about a token nobody holds any more; either
+    // one, acted on, would undo the session that replaced it.
+    const superseded = (): boolean => getRefreshToken() !== refresh;
+    const sessionUsable = (): boolean => checkTokenStatus().action !== 'logout';
     try {
         const body = await mojoCall(REFRESH_PATH, { method: 'POST', body: { refresh_token: refresh } });
-        // The session changed while this POST was in flight (a new login was
-        // adopted, or logout): never write the old session's pair over it.
-        if (getRefreshToken() !== refresh) return getRefreshToken() != null;
+        if (superseded()) return sessionUsable();
         const pkg = body.data as { access_token: string; refresh_token?: string };
         setTokens(pkg.access_token, pkg.refresh_token, persistent);
         emitAuth('refreshed');
         return true;
     } catch (error) {
+        if (superseded()) return sessionUsable();
         const status = error instanceof Error && 'status' in error ? (error as { status: number }).status : 0;
         if (status === 401 || status === 403) {
             emitAuth('unauthorized');
@@ -847,7 +854,9 @@ export function handleAuthCodeFromURL(): Promise<AuthUser | null> {
 function scrubUrl(params: URLSearchParams, hash: string): void {
     const remaining = params.toString();
     const clean = window.location.pathname + (remaining ? `?${remaining}` : '') + hash;
-    window.history.replaceState({}, '', clean);
+    // Keep the entry's state: react-router's {usr, key, idx} lives there and
+    // useBlocker needs it on Back (#5925).
+    window.history.replaceState(window.history.state, '', clean);
 }
 
 // ── Hosted auth pages (the django-mojo /auth "bouncer" pages) ─────────
@@ -928,6 +937,11 @@ export function initAuth(): void {
             const token = getAccessToken();
             return token ? `Bearer ${token}` : null;
         },
+        tokensReplaced(tokens) {
+            // Same storage the session already lives in (remember-me), read
+            // before setTokens clears both.
+            setTokens(tokens.access_token, tokens.refresh_token, sessionIsPersistent());
+        },
     });
     if (getRefreshToken()) startAutoRefresh();
 }

package/src/client/client.ts

@@ -4,7 +4,9 @@
 //   - Envelope: {status, ...} — status:false carries error/message. Unwrapped
 //     HERE, at exactly one boundary. A failed save REJECTS (MojoError); it is
 //     never resolved as success. (web-mojo's Model.save() never-rejects trap
-//     is deliberately not carried forward.)
+//     is deliberately not carried forward.) A handler's flat refusal inside
+//     the 200 — top-level `success:false` — rejects too (ActionRefusedError,
+//     #5922) unless the call passes `refusal: 'return'`.
 //   - Lists: {status, data: T[], count, size, start} → MojoList<T>.
 //   - Singles: {status, data: T} → T.
 //   - Paging: start/size. Sort: 'field' | '-field'. Filters: Django lookups.
@@ -15,7 +17,7 @@
 //
 // With VITE_MOJO_API unset the transport is the in-memory mock; set it to a
 // django-mojo origin and the same code talks to the real backend.
-import { MojoError } from './errors';
+import { ActionRefusedError, MojoError, readActionResult } from './errors';
 import { assertScoped } from './endpoint-scope';
 import { DUID_HEADER, getDuid } from './duid';
 import type { MojoList, Params } from './types';
@@ -48,7 +50,8 @@ export function apiOrigin(): string {
  * TanStack Query defaults tuned for the mojo protocol — spread these into the
  * app's QueryClient:
  *   · 4xx MojoErrors never retry (a 404/401/403 is deterministic — retrying
- *     it only delays the error surfacing, e.g. the group-context fallback)
+ *     it only delays the error surfacing, e.g. the group-context fallback);
+ *     nor does an inside-the-200 refusal (the same request gets the same no)
  *   · networkMode 'always' under the mock (an in-memory backend can't be
  *     offline; online-pausing would wedge failures forever), 'online' for
  *     real backends.
@@ -59,6 +62,7 @@ export function mojoQueryDefaults() {
             networkMode: (usingMockTransport() ? 'always' : 'online') as 'always' | 'online',
             retry: (failureCount: number, error: unknown): boolean => {
                 if (error instanceof MojoError && error.status >= 400 && error.status < 500) return false;
+                if (error instanceof ActionRefusedError) return false;
                 return failureCount < 1;
             },
             // No refetch storm on window focus (web-mojo parity: freshness
@@ -91,6 +95,12 @@ export interface FetchOpts {
     /** Explicit opt-out from a registered endpoint scope (scoped.ts) — for
      *  genuinely global calls inside a scoped family. Greppable, never silent. */
     unscoped?: boolean;
+    /** A flat `success:false` inside the 200 is a handler's refusal: by
+     *  default ('reject') unwrap rejects it with ActionRefusedError. 'return'
+     *  resolves it as a result, for calls whose `success:false` is a real
+     *  answer (a connection test) or that read the refusal themselves (the
+     *  action layer). Greppable, never silent. */
+    refusal?: 'reject' | 'return';
 }
 
 export interface Envelope {
@@ -103,6 +113,18 @@ export interface Envelope {
     count?: number;
     size?: number;
     start?: number;
+    /**
+     * A replacement session pair, beside `data`. django-mojo sends it when the
+     * request ended every other session of the caller's own account — today a
+     * save that changed the caller's own password (User.on_rest_save_and_respond).
+     * The tokens the request was sent with are already dead.
+     */
+    tokens?: SessionTokens;
+}
+
+export interface SessionTokens {
+    access_token: string;
+    refresh_token?: string;
 }
 
 /** Installed by auth (initAuth). The transport stays auth-agnostic. */
@@ -111,6 +133,9 @@ export interface AuthHooks {
     preRequest(path: string): Promise<void>;
     /** Authorization header value, or null when no session exists. */
     authHeader(): string | null;
+    /** The server replaced this session's tokens (Envelope.tokens): store them.
+     *  Optional: a harness that installs its own hooks holds no stored session. */
+    tokensReplaced?(tokens: SessionTokens): void;
 }
 
 let authHooks: AuthHooks | null = null;
@@ -178,6 +203,18 @@ async function unwrap(path: string, opts: FetchOpts): Promise<Envelope> {
             body.data,
         );
     }
+    // Stored here, at the one boundary, so every caller is covered: a save
+    // that changed the caller's own password comes back with the only tokens
+    // that still work. Dropping them would sign the user out on the next call.
+    if (body.tokens && typeof body.tokens.access_token === 'string' && body.tokens.access_token) {
+        authHooks?.tokensReplaced?.(body.tokens);
+    }
+    // Flat only: a top-level success:false is always the handler's own reply
+    // (model actions answer flat). A wrapped data.success:false can be
+    // ordinary data on a successful POST, so it stays data here.
+    if ((body as { success?: unknown }).success === false && opts.refusal !== 'return') {
+        throw new ActionRefusedError(path, readActionResult(body));
+    }
     return body;
 }
 
@@ -200,8 +237,8 @@ export async function mojoList<T>(endpoint: string, params: Params = {}): Promis
     };
 }
 
-export async function mojoGet<T>(endpoint: string, id: number | string): Promise<T> {
-    const body = await unwrap(`${endpoint}/${id}`, {});
+export async function mojoGet<T>(endpoint: string, id: number | string, opts: { unscoped?: boolean } = {}): Promise<T> {
+    const body = await unwrap(`${endpoint}/${id}`, { unscoped: opts.unscoped });
     return body.data as T;
 }
 
@@ -226,10 +263,12 @@ export async function mojoMetrics(params: Params): Promise<MetricsResponse> {
     };
 }
 
-/** Create (no id) or update (with id). Rejects on any failure. */
-export async function mojoSave<T>(endpoint: string, id: number | string | null, changes: Record<string, unknown>): Promise<T> {
+/** Create (no id) or update (with id). Rejects on any failure. `unscoped`
+ *  is the record-route opt-out from a registered scope (FetchOpts.unscoped);
+ *  mojoGet and mojoDelete take the same option. */
+export async function mojoSave<T>(endpoint: string, id: number | string | null, changes: Record<string, unknown>, opts: { unscoped?: boolean } = {}): Promise<T> {
     const path = id == null ? endpoint : `${endpoint}/${id}`;
-    const body = await unwrap(path, { method: 'POST', body: changes });
+    const body = await unwrap(path, { method: 'POST', body: changes, unscoped: opts.unscoped });
     return body.data as T;
 }
 
@@ -238,8 +277,8 @@ export async function mojoSave<T>(endpoint: string, id: number | string | null,
  * envelope's only non-boolean status; it passes the unwrap's `=== false`
  * failure check by design). Failures reject like every other call.
  */
-export async function mojoDelete(endpoint: string, id: number | string): Promise<void> {
-    await unwrap(`${endpoint}/${id}`, { method: 'DELETE' });
+export async function mojoDelete(endpoint: string, id: number | string, opts: { unscoped?: boolean } = {}): Promise<void> {
+    await unwrap(`${endpoint}/${id}`, { method: 'DELETE', unscoped: opts.unscoped });
 }
 
 /** Trigger a browser download of an in-memory file. Shared by safe client exports. */

package/src/client/errors.ts

@@ -1,5 +1,7 @@
-// Error types for the mojo client. Own module so client.ts and auth.ts can
-// both import them without a dependency cycle.
+// Error types for the mojo client, and the one reader for inside-the-200
+// refusals. Own module so client.ts, auth.ts and action-result.ts can all
+// import them without a dependency cycle: client.ts's unwrap builds its
+// refusal error from readActionResult (#5922).
 
 export class MojoError extends Error {
     status: number;
@@ -31,3 +33,56 @@ export class AuthRequiredError extends MojoError {
         this.reason = 'unauthorized';
     }
 }
+
+export interface ActionResult {
+    /** False when the handler refused inside the 200. */
+    ok: boolean;
+    /** Semantic refusal code (`WRONG_STATUS`, `MISSING_DETAILS`, …). */
+    code?: string;
+    /** Server-provided human error text. */
+    error?: string;
+    /** Envelope ⊕ action dict (action fields win) — one-shot secrets,
+     *  counts etc. read from here regardless of wire shape. */
+    payload: Record<string, unknown>;
+}
+
+/**
+ * The one reader for django-mojo refusals inside an HTTP 200: flat
+ * `{success:false}`, wrapped `{data:{success:false}}`, and the payload
+ * `status:false` spelling (`revoke_sessions`). A refusal with no string
+ * `error` falls back to a string `message` — diagnostics and provider
+ * refusals put the human text there.
+ */
+export function readActionResult(out: unknown): ActionResult {
+    const env = (typeof out === 'object' && out !== null ? out : {}) as Record<string, unknown>;
+    const data = (typeof env.data === 'object' && env.data !== null ? env.data : {}) as Record<string, unknown>;
+    const payload = { ...env, ...data };
+    const refused = env.success === false
+        || data.success === false
+        || data.status === false; // the `status`-spelling oddball (revoke_sessions)
+    const code = typeof payload.code === 'string' && payload.code ? payload.code : undefined;
+    const text = (value: unknown) => (typeof value === 'string' && value ? value : undefined);
+    const error = text(payload.error) ?? (refused ? text(payload.message) : undefined);
+    return { ok: !refused, code, error, payload };
+}
+
+/**
+ * A refused action or call. `status` is 200 on purpose — the HTTP layer
+ * succeeded; the HANDLER said no. `errorCode` carries the refusal code,
+ * `data` the merged payload (may hold evidence like the current row status).
+ * `action` labels the message: the action name from the action layer, the
+ * request path from unwrap.
+ */
+export class ActionRefusedError extends MojoError {
+    result: ActionResult;
+    constructor(action: string, result: ActionResult) {
+        super(
+            result.error ?? (result.code ? `${action} refused (${result.code})` : `${action} was refused by the server`),
+            200,
+            result.code,
+            result.payload,
+        );
+        this.name = 'ActionRefusedError';
+        this.result = result;
+    }
+}

package/src/client/group-context.ts

@@ -20,6 +20,8 @@ export interface GroupContextValue {
     member: MemberLike | null;
     /** True while boot resolution or a switch is in flight. */
     loading: boolean;
+    /** Definitive group/member read denial. Consumers must fence cached private workspaces. */
+    accessDenied?: boolean;
     setActiveGroup(group: Group): void;
     clearActiveGroup(): void;
 }

package/src/client/group.tsx

@@ -8,15 +8,23 @@
 //   · on activation the user's member record for that group is fetched
 //     (`/api/group/<id>/member`) — group-context permissions flow from it
 //   · URL-group failure falls back to the stored group, then to none
-import { useContext, useEffect, useMemo, useState, type ReactNode } from 'react';
-import { useQuery, useQueryClient } from '@tanstack/react-query';
-import { mojoCall, mojoGet } from './client';
+import { useContext, useEffect, useLayoutEffect, useMemo, useReducer, useRef, useState, type ReactNode } from 'react';
+import { useQuery, useQueryClient, type QueryClient } from '@tanstack/react-query';
+import { mojoCall, mojoQueryDefaults, MojoError } from './client';
+import { getAuthSnapshot } from './auth';
 import { useAuthSnapshot } from './me';
 import type { MemberLike } from './me';
 import { GroupContext, type Group, type GroupContextValue } from './group-context';
 import { setActiveGroupSignal } from './active-group';
 
 const STORAGE_KEY = 'active_group_id';
+const denied = (error: unknown) => error instanceof MojoError && [401, 403, 404].includes(error.status);
+const temporary = (error: unknown) => !(error instanceof MojoError) || error.status === 0 || error.status >= 500 || [408, 429].includes(error.status);
+const retry = (count: number, error: unknown) => !(error instanceof Error && error.name === 'AbortError') && mojoQueryDefaults().queries.retry(count, error);
+// Query keeps old data when a refetch fails, and its latest error can change
+// from 403 to 503. A known denial outlives either that error or a switcher row.
+// Share its lifetime with the cache, including provider remounts.
+const denials = new WeakMap<QueryClient, Map<string, { group: boolean; member: boolean }>>();
 
 function readUrlGroupParam(): string | null {
     if (typeof window === 'undefined') return null;
@@ -28,7 +36,9 @@ function writeUrlGroupParam(id: number | null): void {
     if (id == null) params.delete('group');
     else params.set('group', String(id));
     const qs = params.toString();
-    window.history.replaceState({}, '', window.location.pathname + (qs ? `?${qs}` : '') + (window.location.hash || ''));
+    // Keep the entry's state: react-router's {usr, key, idx} lives there and
+    // useBlocker needs it on Back (#5925).
+    window.history.replaceState(window.history.state, '', window.location.pathname + (qs ? `?${qs}` : '') + (window.location.hash || ''));
 }
 
 function loadStoredGroupId(): number | null {
@@ -62,67 +72,149 @@ export function GroupProvider({ children }: { children: ReactNode }) {
         if (Number.isFinite(urlId) && urlId > 0) return urlId;
         return loadStoredGroupId();
     });
+    const current = useRef({ groupId, uid: auth.uid, authenticated: auth.authenticated, generation: 0 });
+    const mounted = useRef(true);
+    if (current.current.groupId !== groupId || current.current.uid !== auth.uid || current.current.authenticated !== auth.authenticated)
+        current.current = { groupId, uid: auth.uid, authenticated: auth.authenticated, generation: current.current.generation + 1 };
+    const deniedGroups = denials.get(queryClient) ?? new Map<string, { group: boolean; member: boolean }>();
+    denials.set(queryClient, deniedGroups);
+    const [, rerender] = useReducer((value: number) => value + 1, 0);
+    const denialFor = (id: number, uid: typeof auth.uid) => {
+        const key = JSON.stringify([uid, id]);
+        let denial = deniedGroups.get(key);
+        if (!denial) deniedGroups.set(key, denial = { group: false, member: false });
+        return denial;
+    };
+    const select = (id: number | null) => {
+        current.current = { ...current.current, groupId: id, generation: current.current.generation + 1 };
+        setGroupId(id);
+        rerender();
+    };
+    const assert = (id: number, uid: typeof auth.uid, generation: number, signal: AbortSignal) => {
+        signal.throwIfAborted();
+        const actor = getAuthSnapshot();
+        if (!mounted.current || !actor.authenticated || actor.uid !== uid || current.current.uid !== uid || current.current.groupId !== id || current.current.generation !== generation)
+            throw new DOMException('Group or account changed', 'AbortError');
+    };
 
     const groupQuery = useQuery({
         queryKey: ['group', groupId, auth.uid],
-        queryFn: () => mojoGet<Group>('/api/group', groupId!),
+        queryFn: async ({ signal }) => {
+            const id = groupId!, uid = auth.uid, generation = current.current.generation;
+            const check = () => assert(id, uid, generation, signal);
+            check();
+            try {
+                const result = await mojoCall(`/api/group/${id}`, { signal, beforeSend: check });
+                check();
+                denialFor(id, uid).group = false;
+                return result.data as Group;
+            } catch (error) {
+                check();
+                if (denied(error)) Object.assign(denialFor(id, uid), { group: true, member: true });
+                throw error;
+            }
+        },
         enabled: auth.authenticated && groupId != null,
         staleTime: 5 * 60_000,
+        retry,
     });
 
     // web-mojo's fallback chain: a failing URL/stored group falls back to the
     // stored one (when different), else the context clears entirely.
     useEffect(() => {
-        if (!groupQuery.isError || groupId == null) return;
+        if (!groupQuery.isError || groupId == null || (groupQuery.data && temporary(groupQuery.error))) return;
         const stored = loadStoredGroupId();
         if (stored != null && stored !== groupId) {
             console.warn(`[portal-mojo] active group ${groupId} failed to load; falling back to stored group ${stored}`);
             writeUrlGroupParam(stored);
-            setGroupId(stored);
+            select(stored);
         } else {
             console.warn(`[portal-mojo] active group ${groupId} failed to load; clearing group context`);
             clearStoredGroupId();
             writeUrlGroupParam(null);
-            setGroupId(null);
+            select(null);
         }
-    }, [groupQuery.isError, groupId]);
+    }, [groupQuery.isError, groupQuery.data, groupQuery.error, groupId]);
 
-    const group = groupId != null ? (groupQuery.data ?? null) : null;
+    const groupDenied = groupId != null && (denialFor(groupId, auth.uid).group || denied(groupQuery.error));
+    const group = auth.authenticated && groupId != null && !groupDenied ? (groupQuery.data ?? null) : null;
 
     // Mirror the RESOLVED group into the module signal (scoped.ts's plain-fn
     // consumers). The loaded id, not the candidate — a failing/loading group
     // must not scope requests. Cleared on unmount.
-    useEffect(() => {
+    //
+    // LAYOUT timing is load-bearing (#5918). A child's query starts its fetch
+    // from a passive effect, and React runs child passive effects before this
+    // provider's, so a passive write here left the first request after a
+    // switch carrying the previous group. A layout effect runs for committed
+    // trees only and before every passive effect.
+    useLayoutEffect(() => {
         setActiveGroupSignal(group?.id ?? null);
     }, [group?.id]);
-    useEffect(() => () => setActiveGroupSignal(null), []);
+    useLayoutEffect(() => {
+        mounted.current = true;
+        return () => {
+            mounted.current = false;
+            current.current.generation++;
+            setActiveGroupSignal(null);
+        };
+    }, []);
 
     const memberQuery = useQuery({
         queryKey: ['group-member', group?.id, auth.uid],
-        queryFn: async () => (await mojoCall(`/api/group/${group!.id}/member`)).data as MemberLike,
+        queryFn: async ({ signal }) => {
+            const id = group!.id, uid = auth.uid, generation = current.current.generation;
+            const check = () => assert(id, uid, generation, signal);
+            check();
+            try {
+                const result = await mojoCall(`/api/group/${id}/member`, { signal, beforeSend: check });
+                check();
+                denialFor(id, uid).member = false;
+                return result.data as MemberLike;
+            } catch (error) {
+                check();
+                if (denied(error)) denialFor(id, uid).member = true;
+                throw error;
+            }
+        },
         enabled: auth.authenticated && group != null,
         staleTime: 5 * 60_000,
+        retry,
     });
 
+    const memberDenied = groupId != null && (denialFor(groupId, auth.uid).member || denied(memberQuery.error));
     const value = useMemo<GroupContextValue>(() => ({
         group,
-        member: (group != null ? memberQuery.data : null) ?? null,
+        member: (group != null && !memberDenied ? memberQuery.data : null) ?? null,
+        accessDenied: groupDenied || memberDenied,
         loading: auth.authenticated && groupId != null
             && (groupQuery.isLoading || (group != null && memberQuery.isLoading)),
         setActiveGroup(next: Group) {
-            // Seed the cache with the row the switcher already holds — no
-            // refetch flash on switch.
-            queryClient.setQueryData(['group', next.id, auth.uid], next);
+            const groupKey = ['group', next.id, auth.uid];
+            const memberKey = ['group-member', next.id, auth.uid];
+            const denial = denialFor(next.id, auth.uid);
+            if (denial.group || denial.member || denied(queryClient.getQueryState(groupKey)?.error) || denied(queryClient.getQueryState(memberKey)?.error)) {
+                // Selecting an old row cannot re-authorize a denied context.
+                // Forget both cached reads; keep the latch until each actual
+                // guarded request succeeds.
+                void queryClient.cancelQueries({ queryKey: groupKey, exact: true });
+                void queryClient.cancelQueries({ queryKey: memberKey, exact: true });
+                queryClient.removeQueries({ queryKey: groupKey, exact: true });
+                queryClient.removeQueries({ queryKey: memberKey, exact: true });
+            } else {
+                // An authorized switcher row avoids an ordinary refetch flash.
+                queryClient.setQueryData(groupKey, next);
+            }
             saveStoredGroupId(next.id);
             writeUrlGroupParam(next.id);
-            setGroupId(next.id);
+            select(next.id);
         },
         clearActiveGroup() {
             clearStoredGroupId();
             writeUrlGroupParam(null);
-            setGroupId(null);
+            select(null);
         },
-    }), [group, memberQuery.data, memberQuery.isLoading, groupQuery.isLoading, groupId, auth.authenticated, auth.uid, queryClient]);
+    }), [group, memberQuery.data, memberDenied, memberQuery.isLoading, groupDenied, groupQuery.isLoading, groupId, auth.authenticated, auth.uid, queryClient]);
 
     return <GroupContext.Provider value={value}>{children}</GroupContext.Provider>;
 }

package/src/client/hooks.ts

@@ -32,7 +32,8 @@ export function useModel<T>(endpoint: string, id: number | string | null, saniti
     return useQuery({
         queryKey: [endpoint, 'one', id],
         queryFn: async () => {
-            const row = await mojoGet<T>(endpoint, id!);
+            // A REST record route: the server binds the row's own group (#5923).
+            const row = await mojoGet<T>(endpoint, id!, { unscoped: true });
             return sanitizeRow ? sanitizeRow(row) : row;
         },
         enabled: id != null,
@@ -43,8 +44,11 @@ export function useModel<T>(endpoint: string, id: number | string | null, saniti
 export function useSaveModel<T>(endpoint: string) {
     const qc = useQueryClient();
     return useMutation({
-        mutationFn: ({ id, changes }: { id: number | string | null; changes: Record<string, unknown> }) =>
-            mojoSave<T>(endpoint, id, changes),
+        // With an id this is a REST record route: the server binds the row's
+        // own group (#5923). A create still sends only the caller's changes.
+        mutationFn: ({ id, changes }: { id: number | string | null; changes: Record<string, unknown> }) => id == null
+            ? mojoSave<T>(endpoint, id, changes)
+            : mojoSave<T>(endpoint, id, changes, { unscoped: true }),
         onSuccess: () => qc.invalidateQueries({ queryKey: [endpoint] }),
     });
 }