fix: take back certificate grants when a session ends without a sign-out

stores/__tests__/auth-store-logout-hooks.test.ts

@@ -158,6 +158,17 @@ describe('sign-out with plugins', () => {
       expect(clearGrants).toHaveBeenCalledTimes(1);
     });
 
+    it('and when a session ends with no sign-out at all', () => {
+      const clearGrants = vi.fn().mockResolvedValue(undefined);
+      withBridge(clearGrants);
+      useAuthStore.setState({ isAuthenticated: true, activeAccountId: 'a1' });
+      expect(clearGrants).not.toHaveBeenCalled();
+      useAuthStore.setState({ client: null, isAuthenticated: false, activeAccountId: null });
+      expect(clearGrants).toHaveBeenCalledTimes(1);
+      useAuthStore.setState({ isAuthenticated: true, activeAccountId: 'a1' });
+      expect(clearGrants, 'nothing to take back when one starts').toHaveBeenCalledTimes(1);
+    });
+
     it('signs out all the same on a shell without the call, or one that fails', async () => {
       withBridge(undefined);
       await useAuthStore.getState().logout();

stores/auth-store.ts

@@ -3900,8 +3900,10 @@ useAuthStore.subscribe((state, prev) => {
   const wasReady = prev.isAuthenticated && !!prev.client && !!prev.activeAccountId;
   if (ready && !wasReady) void authHooks.onAuthReady.emit({ accountId: state.activeAccountId });
   if (state.activeAccountId !== prev.activeAccountId) noteDesktopCertificateAccount(state.activeAccountId);
+  // Whenever the account in use goes, not only at a sign-out: an expired or refused session
+  // ends with no account, and the next person at this computer has to be asked.
+  if (prev.activeAccountId && state.activeAccountId !== prev.activeAccountId) clearKeystoreGrants();
   if (state.activeAccountId && prev.activeAccountId && state.activeAccountId !== prev.activeAccountId) {
-    clearKeystoreGrants();
     clearDesktopCrashFiles();
     void authHooks.onAccountSwitch.emit({ accountId: state.activeAccountId, previousAccountId: prev.activeAccountId });
   }