fix: isolate local data by signed-in user

apps/web/src/stores/entries.ts

@@ -5,6 +5,7 @@ import { db } from "../data/db";
 import { localDate } from "../data/entries";
 import { createId } from "../data/ids";
 import { useAuthStore } from "./auth";
+import { useLedgerStore } from "./ledgers";
 
 let syncPromise: Promise<void> | null = null;
 let syncTriggersStarted = false;
@@ -45,6 +46,7 @@ function scheduleConversionPoll(entryIds: string[], resetAttempts = true) {
 export const useEntryStore = defineStore("entries", {
   state: () => ({
     entries: [] as LedgerEntry[],
+    loadedForUserId: "",
     pendingEntryIds: [] as string[],
     pendingEntries: [] as Array<{ id: string; ledgerIds: string[] }>,
     syncing: false,
@@ -53,15 +55,38 @@ export const useEntryStore = defineStore("entries", {
   }),
   actions: {
     async loadEntries() {
+      const auth = useAuthStore();
+      if (this.loadedForUserId !== (auth.user?.id ?? "")) {
+        this.entries = [];
+        this.pendingEntryIds = [];
+        this.pendingEntries = [];
+        this.loadedForUserId = auth.user?.id ?? "";
+      }
+      await useLedgerStore().loadLedgers();
       await this.refreshLocalEntries();
       this.startSyncTriggers();
       void this.syncEntries();
     },
     async refreshLocalEntries() {
+      const auth = useAuthStore();
+      if (!auth.user) {
+        this.entries = [];
+        this.pendingEntryIds = [];
+        this.pendingEntries = [];
+        this.loadedForUserId = "";
+        return;
+      }
+      const allowedLedgerIds = new Set(useLedgerStore().ledgers.map((ledger) => ledger.id));
+      const canAccessEntry = (entry: LedgerEntry) =>
+        entry.ownerId === auth.user!.id || entry.ledgerIds.some((ledgerId) => allowedLedgerIds.has(ledgerId));
       this.entries = (await db.entries.orderBy("occurredAt").reverse().toArray()).filter(
-        (entry) => entry.deletedAt === null,
+        (entry) => entry.deletedAt === null && canAccessEntry(entry),
+      );
+      const pendingOperations = (await db.syncOperations.filter((operation) => operation.syncedAt === null).toArray())
+        .filter((operation) =>
+          (operation.userId ?? operation.payload.updatedBy) === auth.user!.id
+          || operation.ledgerIds.some((ledgerId) => allowedLedgerIds.has(ledgerId)),
         );
-      const pendingOperations = await db.syncOperations.filter((operation) => operation.syncedAt === null).toArray();
       this.pendingEntryIds = [...new Set(pendingOperations.map((operation) => operation.entityId))];
       this.pendingEntries = [...new Map(
         pendingOperations.map((operation) => [operation.entityId, { id: operation.entityId, ledgerIds: operation.ledgerIds }]),

apps/web/src/stores/ledgers.ts

@@ -63,7 +63,7 @@ export const useLedgerStore = defineStore("ledgers", {
           .filter((entry) => entry.ownerId !== auth.user!.id && entry.ledgerIds.some((ledgerId) => !allowedIds.has(ledgerId)))
           .map((entry) => ({ ...entry, ledgerIds: entry.ledgerIds.filter((ledgerId) => allowedIds.has(ledgerId)) }));
         const inaccessibleOperations = await db.syncOperations
-          .filter((item) => !item.ledgerIds.some((ledgerId) => allowedIds.has(ledgerId)))
+          .filter((item) => (item.userId ?? item.payload.updatedBy) !== auth.user!.id)
           .primaryKeys();
         await db.transaction("rw", db.ledgers, db.entries, db.syncOperations, async () => {
           await db.ledgers.clear();
@@ -89,6 +89,8 @@ export const useLedgerStore = defineStore("ledgers", {
     },
     async reloadLedgers() {
       this.loaded = false;
+      this.ledgers = [];
+      this.currentLedgerId = "";
       this.currentMembers = [];
       await this.loadLedgers();
     },