Repository navigation
RV-F1 (BR-36): browser localStorage history leaks across tenants — pending #154 frontend decision #176
Description
What was found
External repository review at commit c7bebd1 reproduced (mocked, not live browser) a BR-36 (tenant isolation) gap in the current Lovable-generated frontend: localStorage-backed upload history is held under a single global key, not scoped per tenant or user. A mocked tenant-A → logout → tenant-B flow retained tenant A's filenames and rejected cell values for tenant B to see.
Backend schema isolation is working (M2 tests across 268-308 passing). This is a frontend-only state leak at the shared browser origin.
Code paths named by the review:
csv-table-hub-main/src/hooks/use-local-storage.tsL3–25csv-table-hub-main/src/lib/session.tsL49–54 (logout clears only session token)csv-table-hub-main/src/routes/audit.tsxL47–57 (history screen reads unscoped key)
Status: pending #154
The current Lovable-generated frontend is under reconsideration (#154 Streamlit spike, areas/frontend-reconsideration-2026-11-02.md). No fix option is being chosen for this issue today because the fix depends on which frontend the project moves to:
- Current Lovable frontend retained → server-backed tenant-scoped history to match M3/M4's "server owns the truth" pattern
- Streamlit replacement → Streamlit's own session model supersedes this entirely; the leak code goes away with the component
- Different framework again → re-evaluate at that time
The security review (#112) that gates the first external tenant will see this issue and determine whether a stopgap is needed before #154 settles.
Done when
- Spike: rebuild M4 review screen in Streamlit (1-day time-box) #154 has settled on a frontend direction.
- The chosen direction's handling of this leak is implemented and tested (either as a replacement, a scoped-storage patch on the current frontend, or confirmed-moot by rebuild).
- A live-browser test (not mocked) demonstrates the leak is closed.
Reference
Tracker row G44 (main tab). Repo review finding RV-F1. BR-36. Related: #154 (frontend reconsideration), #112 (security review, gates first external tenant), areas/frontend-reconsideration-2026-11-02.md.
Activity
amar-python commentedon Nov 9, 2026
Closing as moot: #154 settled on Streamlit (outcome 1), so this goes away with the React frontend. Migration plan is tracked in #212. Note the React code still ships until that migration lands; the #112 security review that gates the first external tenant should decide whether a stopgap is needed in the meantime.
Generated by Claude Code
test: drop the #181 expected-fail test; CI fails any skip
test(a11y): seed import history under the signed-in user's key (#176)
Merge pull request #235 from amar-python/claude/fix-176-tenant-scoped…
amar-python commentedon Nov 10, 2026
Fixed in #235 (merged as db5c9b7). Upload history and saved mapping templates are now kept per signed-in tenant and user, and nothing is stored when nobody is signed in. The old unscoped entries are dropped on first load, so existing users lose their local history and saved templates once. Verified in Chromium on the production build: a second tenant's history page no longer lists the first tenant's file (
e2e/test_react_ui.py, and 11 vitest tests intenant-isolation.test.tsx). Reopening-and-closing as completed, since the leak is closed in what ships, not just moot.Generated by Claude Code