Clear persisted query cache on logout

[bodhish]

Closes #16509

Stacked on #16514 (uses the Vitest harness for the new test). GitHub will retarget this to develop when that merges.

What

Cached application state must not survive sign-out on shared devices — but the persisted TanStack Query blob (REACT_QUERY_OFFLINE_CACHE in localStorage) previously outlived logout:

• clearQueryPersistenceCache() only called invalidateQueries (marks stale; removes nothing) and had zero callers.
• signOut removed the auth-token keys but never touched the persisted cache.

Changes:

• src/Utils/request/queryClient.ts: persister key is now explicit; clearQueryPersistenceCache() does removeQueries on meta.persist === true entries and persister.removeClient() (actually deletes the localStorage entry), returning the promise so callers can await.
• src/Providers/AuthUserProvider.tsx: signOut awaits the purge right after the token removals. The cross-tab storage listener funnels through the same signOut, so other tabs are covered.

Verification

• npm run typecheck → exit 0
• npm run test:unit → 6/6, including a new jsdom test proving the localStorage entry is gone after the purge
• grep invalidateQueries src/Utils/request/queryClient.ts → no matches

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3efebf9e-7ab5-4516-b216-c004a5d29516

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issues/16509/clear-persisted-cache-on-logout

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Merge Checklist Incomplete

Thank you for your contribution! To help us review your PR efficiently, please complete the merge checklist in your PR description.

Your PR will be reviewed once you have marked the appropriate checklist items.

To update the checklist:

• Change - [ ] to - [x] for completed items
• Only check items that are relevant to your PR
• Leave items unchecked if they don't apply

The checklist helps ensure code quality, testing coverage, and documentation are properly addressed.

[cloudflare-workers-and-pages]

Deploying care-preview with    Cloudflare Pages

Latest commit:	5143d09
Status:	✅  Deploy successful!
Preview URL:	https://50e445d9.care-preview-a7w.pages.dev
Branch Preview URL:	https://issues-16509-clear-persisted.care-preview-a7w.pages.dev

View logs

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5143d09328

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[greptile-apps]

Greptile Summary

This PR fixes a security gap where the TanStack Query persisted cache (REACT_QUERY_OFFLINE_CACHE in localStorage) survived logout on shared devices. The previous clearQueryPersistenceCache only called invalidateQueries (marks stale, removes nothing) and had no callers; the new implementation correctly uses removeQueries to evict in-memory entries and persister.removeClient() to delete the localStorage blob, and signOut now awaits both.

• queryClient.ts: persister key is now explicit; clearQueryPersistenceCache returns Promise<void> and performs both in-memory removal (removeQueries) and storage deletion (removeClient).
• AuthUserProvider.tsx: signOut awaits the purge immediately after token removals, covering both direct and cross-tab logout paths.
• queryClient.test.ts: new jsdom unit test confirms the localStorage entry is absent after calling clearQueryPersistenceCache.

Confidence Score: 4/5

Safe to merge — the core fix correctly clears both in-memory queries and the localStorage blob on logout; one minor edge case with the persistence subscriber may re-create an empty key shortly after logout but no user data is involved.

The fix is correct and the test validates the primary path. The only concern is a timing quirk where the debounced persistQueryClient subscriber can re-write an empty blob to localStorage after removeClient() has cleared it — no user data survives, but the key itself reappears for ~1 s. The cross-tab signout path properly routes through the same signOut function and will clear the cache there too.

src/Utils/request/queryClient.ts — the interaction between removeQueries, the persistence subscriber, and removeClient is worth a second look

Important Files Changed

Filename	Overview
src/Utils/request/queryClient.ts	Fixes clearQueryPersistenceCache to actually delete the localStorage entry via removeClient(), adds explicit persister key, and returns a Promise so callers can await; subtle subscription-write race possible after removeQueries
src/Providers/AuthUserProvider.tsx	Wires clearQueryPersistenceCache into signOut right after token removals; cross-tab storage listener already funnels through the same signOut so both tabs are covered
src/Utils/request/queryClient.test.ts	New jsdom test validates that the localStorage entry is removed after clearQueryPersistenceCache(); only covers the removeClient path, not the removeQueries path

_{Reviews (1): Last reviewed commit: "fix: clear persisted query cache on logo..." | Re-trigger Greptile}