[yashranaway]

in the mobile app, the account bootstrap request and the switch organisation call wrote their result straight into auth state when they came back. if you signed out, or signed in as someone else, while one was still in flight, the late response put the previous user's account and orgs back on screen.

now the auth provider bumps a session revision on sign in and sign out, and those responses are only applied if the revision hasn't changed since the request started. a failed refresh only clears the session it belonged to. the test signs out while a bootstrap is pending.

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are addressed.

Summary

Prevents late account responses from restoring old account data after a session change.

• The mobile app ignores account replies from earlier sign-in sessions.

_{Reviews (2) · Last reviewed commit: "fix(mobile): discard account responses s..." · Reviewed by Greptile}

[yashranaway]

@greptileai review

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 23, 2026 9:40pm UTC

[greptile-apps]

Old account data returns

signOut bumps sessionRevision before waiting for revocation and deleting saved credentials. The old apiKey and callbacks remain active during those waits. A background upload check can call refreshAuth() in that window, capturing the bumped revision while using the old key. If its response arrives after sign-out finishes, the equality check still passes and restores the old bootstrap.

Invalidate requests when credentials are cleared too, or prevent requests from starting while sign-out is pending.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/mobile/src/auth/AuthContext.tsx
Line: 229

Comment:
**Old account data returns**

`signOut` bumps `sessionRevision` before waiting for revocation and deleting saved credentials. The old `apiKey` and callbacks remain active during those waits. A background upload check can call `refreshAuth()` in that window, capturing the bumped revision while using the old key. If its response arrives after sign-out finishes, the equality check still passes and restores the old `bootstrap`.

Invalidate requests when credentials are cleared too, or prevent requests from starting while sign-out is pending.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[yashranaway]

You're right. A refresh could start during revocation with the old key and pick up the bumped revision, so I bump it again once the saved credentials are deleted. There's a regression test for that window now, it failed before the change (79f0150).

[greptile-apps]

Two guards lack regression tests

The new test covers only a successful refresh() response after sign-out. It never exercises the stale-failure guard or the guard in setActiveOrganization. Removing either guard leaves this test passing.

Add deferred tests that reject an old automatic bootstrap after a new sign-in and resolve an old organization switch after a session change. These would catch regressions that clear a new login or replace its account data.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/mobile/src/auth/AuthProvider.test.tsx
Line: 263

Comment:
**Two guards lack regression tests**

The new test covers only a successful `refresh()` response after sign-out. It never exercises the stale-failure guard or the guard in `setActiveOrganization`. Removing either guard leaves this test passing.

Add deferred tests that reject an old automatic bootstrap after a new sign-in and resolve an old organization switch after a session change. These would catch regressions that clear a new login or replace its account data.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[yashranaway]

Added deferred tests for both, an old bootstrap failing after a new sign-in and an old organization switch resolving after a session change (79f0150).

[richiemcilroy]

@greptileai review