From 28f14955e2bdeb8bfed1ca3b2c0111ce07e540c2 Mon Sep 17 00:00:00 2001 From: Paul Nothaft Date: Wed, 2 Sep 2026 09:42:40 +0200 Subject: [PATCH] fix(gallery): clear the guest identity on gallery logout The gallery password is one shared secret per event and does not distinguish people. With the guest identity outliving the tab, logging out and letting the next person enter that password greeted them by the previous guest's name, with "forget me" - which erases that guest's selections server-side - one click away. Logout is the leaving-this-device signal, so it now drops the local identity too. Server row untouched. --- frontend/src/contexts/GalleryAuthContext.tsx | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/frontend/src/contexts/GalleryAuthContext.tsx b/frontend/src/contexts/GalleryAuthContext.tsx index e6d35931..5512d10c 100644 --- a/frontend/src/contexts/GalleryAuthContext.tsx +++ b/frontend/src/contexts/GalleryAuthContext.tsx @@ -11,6 +11,7 @@ import { setActiveGallerySlug, storeGalleryToken, } from '../utils/galleryAuthStorage'; +import { clearGuestIdentity } from '../utils/guestIdentityStorage'; import type { GalleryAccessLevel } from '../types'; interface GalleryEvent { @@ -350,6 +351,12 @@ export const GalleryAuthProvider: React.FC = ({ childr sessionStorage.removeItem(`gallery_event_${currentSlug}`); sessionStorage.removeItem(`gallery_access_level_${currentSlug}`); clearGalleryToken(currentSlug); + // Logout is the "I am leaving this device" signal. Now that the guest + // identity outlives the tab (#1265), leaving it behind would greet the + // next person who enters the shared gallery password by this guest's + // name — with "forget me", which erases THIS guest's selections + // server-side, one click away. Local only; the server row is untouched. + clearGuestIdentity(currentSlug); } authService.galleryLogout(currentSlug || undefined); setIsAuthenticated(false);