updates on the fix

src/components/nearle_components/LocationAutocomplete.js

@@ -27,7 +27,12 @@ const LocationAutocomplete = forwardRef(
     },
     ref
   ) => {
-    const [locations, setLocations] = useState(JSON.parse(localStorage.getItem('applocations') || '[]'));
+    // Tenant-scoped cache key — fetchAppLocations() now narrows the hub list
+    // to the logged-in tenant's own city, so caching under one shared flat
+    // key would leak a previous tenant's list into a different tenant's
+    // session on the same browser if it ever skipped a full logout clear.
+    const applocationsCacheKey = `applocations_${localStorage.getItem('tenantid') || 'staff'}`;
+    const [locations, setLocations] = useState(JSON.parse(localStorage.getItem(applocationsCacheKey) || '[]'));
 
     useEffect(() => {
       // Zones are derived from GET /admin/hubs (the new API has no dedicated
@@ -35,7 +40,7 @@ const LocationAutocomplete = forwardRef(
       const fetchLocations = async () => {
         try {
           const updatedLocations = await fetchAppLocations();
-          localStorage.setItem('applocations', JSON.stringify(updatedLocations));
+          localStorage.setItem(applocationsCacheKey, JSON.stringify(updatedLocations));
           setLocations(updatedLocations);
         } catch (err) {
           console.error('Error fetching locations in LocationAutocomplete:', err);
@@ -45,7 +50,7 @@ const LocationAutocomplete = forwardRef(
       if (locations.length === 0) {
         fetchLocations();
       }
-    }, [locations.length]);
+    }, [locations.length, applocationsCacheKey]);
 
     // Helpers (only used by pill variant) — match the deliveries page's
     // token shorthand so the same opacity ramp is applied here.