Tenant switching does not leak prior tenant data

When a user switches organizations, any prior-tenant data held in client-side state — React Query caches, SWR caches, Zustand stores, or sessionStorage — remains accessible until the browser is refreshed or the cache entry expires. CWE-524 and OWASP A01 both apply: the prior tenant's dashboards, user lists, and documents can be queried by API calls that still carry the old cache entries, or rendered from stale in-memory state. This is particularly dangerous in shared-device scenarios (kiosk, shared workstation) where the next person uses the same browser session.

On tenant switch, invalidate all client-side query caches and force a full page transition to a tenant-neutral route:

async function switchOrganization(newOrgId: string) {
  // Update session server-side first
  await updateSessionOrg(newOrgId)

  // Clear all React Query cache entries
  await queryClient.invalidateQueries()
  // or for guaranteed clearance: queryClient.clear()

  // Navigate to a safe landing page with a full reload
  window.location.href = '/dashboard'
}

Prefer window.location.href (full page reload) over router.push() — client-side navigation leaves in-memory stores intact. If using Zustand or similar, call your store's reset action before the navigation.