fix(client): clear protected views on logout and show customer customs state

src/api/unifiedHttp.test.mjs

@@ -99,6 +99,23 @@ test('late refresh response cannot overwrite a session changed in another tab',
 })
 
 function deferred() { let resolve; const promise = new Promise(yes => { resolve = yes }); return { promise, resolve } }
+
+test('logout after local clear sends only the original refresh token and never refreshes or clears a later login', async () => {
+  const sent = deferred(), release = deferred(), calls = []
+  const http = harness(async config => {
+    calls.push(config); sent.resolve(); await release.promise; throw unauthorized(config)
+  })
+  http.setSession('', '')
+  const api = compile('../modules/auth/api/auth.ts', { '@/api/http': http })
+  const pending = api.logoutMerchant('old-refresh')
+  const rejected = assert.rejects(pending, error => error.code === 'A0401')
+  await sent.promise; http.setSession(otherAccess, 'refresh-b'); release.resolve(); await rejected
+  assert.equal(calls.length, 1)
+  assert.equal(calls[0].url, '/auth/logout')
+  assert.equal(calls[0].headers.Authorization, undefined)
+  assert.deepEqual(JSON.parse(calls[0].data), { refreshToken: 'old-refresh' })
+  assert.deepEqual(http.session(), { token: otherAccess, refreshToken: 'refresh-b' })
+})
 function unauthorized(config) {
   return new axios.AxiosError('Expired', 'ERR_BAD_REQUEST', config, null, { status: 401, data: { code: 'A0401', message: 'Expired' } })
 }