From f0e874103d7cc7ef37af9d740d80f28922f71f4e Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Wed, 4 Nov 2026 03:23:45 +0100
Subject: [PATCH] fix: take back certificate grants when a session ends without
 a sign-out

---
 stores/__tests__/auth-store-logout-hooks.test.ts | 11 +++++++++++
 stores/auth-store.ts                             |  4 +++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/stores/__tests__/auth-store-logout-hooks.test.ts b/stores/__tests__/auth-store-logout-hooks.test.ts
index afdad8ad2..c65882f0e 100644
--- a/stores/__tests__/auth-store-logout-hooks.test.ts
+++ b/stores/__tests__/auth-store-logout-hooks.test.ts
@@ -158,6 +158,17 @@ describe('sign-out with plugins', () => {
       expect(clearGrants).toHaveBeenCalledTimes(1);
     });
 
+    it('and when a session ends with no sign-out at all', () => {
+      const clearGrants = vi.fn().mockResolvedValue(undefined);
+      withBridge(clearGrants);
+      useAuthStore.setState({ isAuthenticated: true, activeAccountId: 'a1' });
+      expect(clearGrants).not.toHaveBeenCalled();
+      useAuthStore.setState({ client: null, isAuthenticated: false, activeAccountId: null });
+      expect(clearGrants).toHaveBeenCalledTimes(1);
+      useAuthStore.setState({ isAuthenticated: true, activeAccountId: 'a1' });
+      expect(clearGrants, 'nothing to take back when one starts').toHaveBeenCalledTimes(1);
+    });
+
     it('signs out all the same on a shell without the call, or one that fails', async () => {
       withBridge(undefined);
       await useAuthStore.getState().logout();
diff --git a/stores/auth-store.ts b/stores/auth-store.ts
index 7953d72a2..1420e14ff 100644
--- a/stores/auth-store.ts
+++ b/stores/auth-store.ts
@@ -3900,8 +3900,10 @@ useAuthStore.subscribe((state, prev) => {
   const wasReady = prev.isAuthenticated && !!prev.client && !!prev.activeAccountId;
   if (ready && !wasReady) void authHooks.onAuthReady.emit({ accountId: state.activeAccountId });
   if (state.activeAccountId !== prev.activeAccountId) noteDesktopCertificateAccount(state.activeAccountId);
+  // Whenever the account in use goes, not only at a sign-out: an expired or refused session
+  // ends with no account, and the next person at this computer has to be asked.
+  if (prev.activeAccountId && state.activeAccountId !== prev.activeAccountId) clearKeystoreGrants();
   if (state.activeAccountId && prev.activeAccountId && state.activeAccountId !== prev.activeAccountId) {
-    clearKeystoreGrants();
     clearDesktopCrashFiles();
     void authHooks.onAccountSwitch.emit({ accountId: state.activeAccountId, previousAccountId: prev.activeAccountId });
   }