@@ -0,0 +1,12 @@
+---
+'@object-ui/auth': patch
+'@object-ui/console': patch
+---
+
+fix(console,auth): after an explicit sign-out, whoever signs in next lands on their own home, not on the page the previous person had open
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+- **`@object-ui/auth`: `AuthContextValue.sessionEndedBySignOut`**, `true` from a `signOut()` until a session is established again in the tab, whoever it belongs to; `false` on load, while signed in, and after a session that ended any other way (expired, revoked, signed out in another tab). It is a new required member of the exported `AuthContextValue` type: code that builds its own value of that type (a test double, a custom provider) must add `sessionEndedBySignOut: false` (or its own reading) to type-check.
+- **`@object-ui/console`: `LoginRedirect`** sends the visitor to `/login` with no `?redirect=` after an explicit sign-out. A new member signing in after the administrator signed out of a Setup page used to land on that page and read "you do not have access to this app". A session that expires or is revoked under the person still keeps the path (list state stripped as before), so that person signs back in where they were.
@@ -18,9 +18,11 @@
  * `LoginRedirect`), and the real Console `LoginPage` with its post-login
  * hand-off. Only the shell's provider stack is a pass-through.
  *
- *   - A signs out of a list carrying every kind of list state; the login page's
- *     URL carries none of it, and B lands on the same path with the other
- *     params kept (the card's reproduction, steps 4 to 7);
+ *   - A's session expires on a list carrying every kind of list state; the
+ *     login page's URL carries none of it, and B lands on the same path with
+ *     the other params kept (the card's reproduction, steps 4 to 7, with the
+ *     session ending by expiry: an explicit sign-out now carries no return link
+ *     at all, pinned in the objectstack#30125 block below);
  *   - an invitation redirect still lands on the invitation;
  *   - a signed-out arrival on a deep link with no list state keeps it byte for
  *     byte;
@@ -34,10 +36,10 @@
 
 import '@testing-library/jest-dom/vitest';
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { render, screen, waitFor, cleanup } from '@testing-library/react';
+import { render, screen, waitFor, cleanup, act } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
-import { MemoryRouter, Routes, Route, useLocation } from 'react-router-dom';
-import type { ReactNode } from 'react';
+import { MemoryRouter, Routes, Route, useLocation, useNavigate } from 'react-router-dom';
+import { useEffect, type ReactNode } from 'react';
 import { AuthProvider, useAuth } from '@object-ui/auth';
 import type { AuthClient } from '@object-ui/auth';
 
@@ -100,24 +102,43 @@ function createClient(): AuthClient {
 
 /** Every location the router settles on, oldest first. */
 const seen: string[] = [];
+/** The router's own navigate, for an in-app move between sign-ins. */
+const navigateTo: { current: ((to: string) => void) | null } = { current: null };
 function LocationProbe() {
   const location = useLocation();
+  const navigate = useNavigate();
+  useEffect(() => {
+    navigateTo.current = navigate;
+  }, [navigate]);
   seen.push(location.pathname + location.search);
   return null;
 }
 
-/** The list page, reduced to the account menu's sign-out. */
+/**
+ * The list page, reduced to the account menu's sign-out and a session
+ * re-resolution: the provider's own loader, which is how a session that
+ * expired or was revoked under the page reaches it.
+ */
 function SignedInList() {
-  const { user, signOut } = useAuth();
+  const { user, signOut, refreshSession } = useAuth();
   return (
     <div data-testid="list-page" data-user={user?.id ?? ''}>
       <button type="button" onClick={() => void signOut()}>
         Sign out
       </button>
+      <button type="button" onClick={() => void refreshSession()}>
+        Re-check session
+      </button>
     </div>
   );
 }
 
+/** The server ends the session on its own (expiry, revocation), and the page learns it. */
+async function expireSession() {
+  serverUser = null;
+  await userEvent.setup().click(screen.getByRole('button', { name: 'Re-check session' }));
+}
+
 function renderConsole(entry: string, client: AuthClient) {
   return render(
     <AuthProvider authUrl="/api/v1/auth" client={client}>
@@ -176,7 +197,7 @@ afterEach(() => {
 });
 
 describe('signing out leaves the list state behind (objectstack#29174)', () => {
-  it('A signs out of a filtered, searched, sorted list; B signs in and lands on the path with none of it', async () => {
+  it("A's session expires on a filtered, searched, sorted list; B signs in and lands on the path with none of it", async () => {
     serverUser = USER_A;
     const client = createClient();
     renderConsole(A_LIST_URL, client);
@@ -185,8 +206,8 @@ describe('signing out leaves the list state behind (objectstack#29174)', () => {
     expect((await screen.findByTestId('list-page')).dataset.user).toBe(USER_A.id);
     expect(seen[seen.length - 1]).toBe(A_LIST_URL);
 
-    await userEvent.setup().click(screen.getByRole('button', { name: 'Sign out' }));
-    expect(client.signOut).toHaveBeenCalledTimes(1);
+    await expireSession();
+    expect(client.signOut).not.toHaveBeenCalled();
 
     // The login page's own URL carries none of it: not the params, not a value.
     const { url, redirect } = await loginRedirect();
@@ -236,3 +257,70 @@ describe('signing out leaves the list state behind (objectstack#29174)', () => {
     expect(redirect).toBe(`${LIST_PATH}?recordId=r1`);
   });
 });
+
+/**
+ * objectstack#30125 — after a sign-out, the next person lands on the previous
+ * person's page. A new member's first screen was "you do not have access to
+ * this app" for the Setup page the administrator had open.
+ *
+ * An explicit sign-out sends the visitor to `/login` with no return link, so
+ * whoever signs in next lands on their own home. A session that ends under the
+ * person (expired, revoked) still keeps the path, so that person signs back in
+ * where they were. Same real composition as the block above.
+ */
+describe('an explicit sign-out leaves no return link (objectstack#30125)', () => {
+  const SETUP_PAGE = '/apps/com.objectstack.setup/sys_user/view/all?recordId=u1';
+
+  it('A signs out of a Setup page; B signs in and lands on home, not on that page', async () => {
+    serverUser = USER_A;
+    const client = createClient();
+    renderConsole(SETUP_PAGE, client);
+    expect((await screen.findByTestId('list-page')).dataset.user).toBe(USER_A.id);
+
+    await userEvent.setup().click(screen.getByRole('button', { name: 'Sign out' }));
+    expect(client.signOut).toHaveBeenCalledTimes(1);
+
+    const { url, redirect } = await loginRedirect();
+    expect(url).toBe('/login');
+    expect(redirect).toBeNull();
+
+    await signInAs(USER_B.email);
+    expect(await landing()).toBe(withConsoleBase('/'));
+  });
+
+  it("A's session expires on the same page; A signs back in and lands on it", async () => {
+    serverUser = USER_A;
+    const client = createClient();
+    renderConsole(SETUP_PAGE, client);
+    expect((await screen.findByTestId('list-page')).dataset.user).toBe(USER_A.id);
+
+    await expireSession();
+
+    const { url, redirect } = await loginRedirect();
+    expect(url).toBe(`/login?redirect=${encodeURIComponent(SETUP_PAGE)}`);
+    expect(redirect).toBe(SETUP_PAGE);
+
+    await signInAs(USER_A.email);
+    expect(await landing()).toBe(withConsoleBase(SETUP_PAGE));
+  });
+
+  it('the sign-out is forgotten once someone signs in: a later expiry keeps the path again', async () => {
+    serverUser = USER_A;
+    const client = createClient();
+    renderConsole(SETUP_PAGE, client);
+    expect((await screen.findByTestId('list-page')).dataset.user).toBe(USER_A.id);
+
+    // A signs out; B signs in on the same tab, without a page load.
+    await userEvent.setup().click(screen.getByRole('button', { name: 'Sign out' }));
+    expect((await loginRedirect()).redirect).toBeNull();
+    await signInAs(USER_B.email);
+    await landing();
+
+    // B opens the page in-app, and B's session then expires under it.
+    act(() => navigateTo.current!(SETUP_PAGE));
+    expect((await screen.findByTestId('list-page')).dataset.user).toBe(USER_B.id);
+    await expireSession();
+
+    expect((await loginRedirect()).redirect).toBe(SETUP_PAGE);
+  });
+});
@@ -12,7 +12,7 @@
 
 import type { ReactNode } from 'react';
 import { useLocation } from 'react-router-dom';
-import { AuthGuard } from '@object-ui/auth';
+import { AuthGuard, useAuth } from '@object-ui/auth';
 import {
   ConnectedShell,
   RequireOrganization,
@@ -29,15 +29,25 @@ import {
  * every embedded deployment, so a window-derived path would carry the `/_console`
  * mount into a value that `LoginPage` then re-prefixes with it (objectui#4168).
  *
- * It never carries the list's `uf_*` state (objectstack#29174). Whoever signs in
- * on that page may not be the person whose session just ended, and a filter
- * value can be sensitive; this guard cannot tell a sign-out from an expiry, so
- * it drops the state for both. The path and every other param are kept, byte
- * for byte when there was no list state, and the list then opens on the
- * signing-in user's own stored state or the view's default.
+ * After an explicit sign-out it carries no return link at all
+ * (objectstack#30125): the person left, so whoever signs in next is nobody in
+ * particular and lands on their own home, not on the page the previous person
+ * had open (a Setup page a new member may not open, say). `AuthProvider` tells
+ * the two apart with `sessionEndedBySignOut`.
+ *
+ * Otherwise (the session expired or was revoked under the person, or a
+ * signed-out visitor followed a deep link) the path and its params are kept, so
+ * the person signs back in where they were. Even then it never carries the
+ * list's `uf_*` state (objectstack#29174): whoever signs in after an expiry may
+ * still be someone else, and a filter value can be sensitive. The
+ * path and every other param are kept, byte for byte when there was no list
+ * state, and the list then opens on the signing-in user's own stored state or
+ * the view's default.
  */
 export function LoginRedirect() {
   const location = useLocation();
+  const { sessionEndedBySignOut } = useAuth();
+  if (sessionEndedBySignOut) return <RedirectWithSplash to="/login" replace />;
   const params = new URLSearchParams(location.search);
   const kept = withoutListStateParams(params).toString();
   const returnSearch = kept === params.toString() ? location.search : kept ? `?${kept}` : '';
 
@@ -16,6 +16,15 @@ export interface AuthContextValue {
   session: AuthClientSession | null;
   /** Whether the user is authenticated */
   isAuthenticated: boolean;
+  /**
+   * objectstack#30125 — `true` when this tab's last session was ended by
+   * `signOut()` and no session has been established since; `false` on load,
+   * while signed in, and after a session that ended any other way (expired,
+   * revoked, signed out in another tab). Lets a sign-in redirect tell "the
+   * person left", where whoever signs in next is nobody in particular, from
+   * "the session lapsed under the person", who comes back to the same page.
+   */
+  sessionEndedBySignOut: boolean;
   /**
    * Whether real authentication is enabled in this environment.
    * - `true`: real auth backend is in use; sign-in / sign-out are meaningful.
 
@@ -191,6 +191,13 @@ export function AuthProvider({
   // finds anything else drops it for good, so every later run loads as before.
   const bootSessionFor = useRef<string | null>(bootSession ? authUrl : null);
   const [error, setError] = useState<Error | null>(null);
+  // objectstack#30125 — the session in this tab was ended by `signOut()`, and
+  // nobody has signed in since. Raised in the same batch that clears `user`, so
+  // the first render without a session already reads it; lowered as soon as a
+  // session exists again (below), whoever it belongs to. A session
+  // that ends any other way (expired, revoked, signed out in another tab)
+  // leaves it `false`.
+  const [sessionEndedBySignOut, setSessionEndedBySignOut] = useState(false);
   const [remediationRequired, setRemediationRequired] = useState<{ code: string; message: string } | null>(null);
   // objectstack#29105 — a password sign-in waiting for its second factor.
   const [twoFactorChallenge, setTwoFactorChallenge] = useState<TwoFactorChallenge | null>(null);
@@ -215,6 +222,11 @@ export function AuthProvider({
     ? user !== null && session !== null
     : true;
 
+  // Any session, a new sign-in or a re-resolved one, ends "signed out".
+  // Adjusted during render (React's "storing information from previous
+  // renders"), so no render ever pairs a session with a raised flag.
+  if (sessionEndedBySignOut && user !== null) setSessionEndedBySignOut(false);
+
   // True while `loadSession` is awaiting the server. Read by the rotation
   // subscription below: a rotation the server performs INSIDE our own
   // `getSession` is already reflected in the answer we are about to apply, and
@@ -482,6 +494,7 @@ export function AuthProvider({
       await client.signOut();
       setUser(null);
       setSession(null);
+      setSessionEndedBySignOut(true);
       setError(null);
       setTwoFactorChallenge(null);
       // The organization block is the previous principal's data too: the list
@@ -1141,6 +1154,7 @@ export function AuthProvider({
       user,
       session,
       isAuthenticated,
+      sessionEndedBySignOut,
       isAuthEnabled,
       isLoading,
       error,
@@ -1196,7 +1210,7 @@ export function AuthProvider({
       listUserInvitations,
     }),
     [
-      user, session, isAuthenticated, isAuthEnabled, isLoading, error, isPreviewMode, previewMode,
+      user, session, isAuthenticated, sessionEndedBySignOut, isAuthEnabled, isLoading, error, isPreviewMode, previewMode,
       signIn, twoFactorChallenge, verifySignInTwoFactor, cancelTwoFactorChallenge, signUp, signOut, refreshSession, updateUser, forgotPassword, sendVerificationEmail, resetPassword, changePassword, setInitialPassword, hasLocalPassword, getAuthConfig, signInWithProvider,
       sendPhoneOtp, signInWithPhoneOtp, signInWithPhonePassword, requestPhonePasswordReset, resetPasswordWithPhoneOtp,
       remediationRequired, enrollTotp, verifyTotp,
 
@@ -31,6 +31,7 @@ export function useAuth(): AuthContextValue {
       user: null,
       session: null,
       isAuthenticated: false,
+      sessionEndedBySignOut: false,
       isAuthEnabled: false,
       isLoading: false,
       error: null,