macltok

public

Star0

Fork 0

Watch0

13 commits 3 branches 0 tags 0 releases3.0 MiB

Commit `713205a95af2`

tarball

atagen <boss@atagen.co>2026-09-27 01:42 UTC

9 files changed+547-85

account: keep the session record behind a SessionStore

Refresh tokens work once, so every host had to hand-roll an atomic encrypted save on SessionTokensChanged and delete the record and the store to match Termination::retain. The record stays out of the sdk's state store because matrix-sdk-sqlite writes custom values unencrypted and a client can't open its store before it knows the homeserver the record holds, so EncryptedSessionStore seals it with a StoreCipher under the store's passphrase. Login and restore take the SessionStore so the first record can't go unsaved.

Modified file: Cargo.lock+2 additions@@ -1830,8 +1830,10 @@ dependencies = [
  "imbl",
  "matrix-sdk",
  "matrix-sdk-crypto",
+ "matrix-sdk-store-encryption",
  "matrix-sdk-test",
  "matrix-sdk-ui",
+ "matrix_indexed_db_futures",
  "mime",
  "reqwest",
  "ruma",

Modified file: Cargo.toml+10 additions−2 deletions@@ -7,9 +7,15 @@ description = "A compact application backend on top of the Matrix Rust SDK"
 [features]
 default = []
 serde = ["dep:serde", "imbl/serde"]
-sqlite = ["matrix-sdk/sqlite", "serde", "dep:url"]
+sqlite = ["matrix-sdk/sqlite", "serde", "dep:url", "dep:matrix-sdk-store-encryption"]
 bundled-sqlite = ["sqlite", "matrix-sdk/bundled-sqlite"]
-indexeddb = ["matrix-sdk/indexeddb", "serde", "dep:url"]
+indexeddb = [
+    "matrix-sdk/indexeddb",
+    "serde",
+    "dep:url",
+    "dep:matrix-sdk-store-encryption",
+    "dep:indexed_db_futures",
+]
 
 [dependencies]
 futures-util = { version = "0.3.31", default-features = false, features = ["std"] }
@@ -17,6 +23,7 @@ http = "1"
 imbl = { version = "6.1.0", default-features = false }
 matrix-sdk = { version = "0.18.0", default-features = false, features = ["e2e-encryption"] }
 matrix-sdk-crypto = { version = "0.18.0", default-features = false }
+matrix-sdk-store-encryption = { version = "0.18.0", optional = true }
 matrix-sdk-ui = { version = "0.18.0", default-features = false }
 ruma = { version = "0.16.0", default-features = false }
 serde = { version = "1.0.219", features = ["derive", "rc"], optional = true }
@@ -31,6 +38,7 @@ url = { version = "2.5.7", optional = true }
 getrandom = { version = "0.2", features = ["js"] }
 getrandom3 = { package = "getrandom", version = "0.3", features = ["wasm_js"] }
 getrandom4 = { package = "getrandom", version = "0.4", features = ["wasm_js"] }
+indexed_db_futures = { package = "matrix_indexed_db_futures", version = "0.7.0", optional = true, features = ["typed-arrays"] }
 matrix-sdk = { version = "0.18.0", default-features = false, features = ["js"] }
 matrix-sdk-ui = { version = "0.18.0", default-features = false, features = ["js"] }
 # the sdk's own wasm reqwest leaves out stream, which the bounded media download needs

Modified file: README.md+13 additions−11 deletions@@ -41,20 +41,22 @@ with `TimelineDiff::try_apply_all`. snapshots are `imbl::Vector`s, re-exported
 as `macltok::imbl`, so a copy costs nothing. when a batch doesn't fit none of it
 lands. stop applying, call `resync`, and pick up from the next `TimelineReset`
 
-With `sqlite` or `indexeddb`, persist the initial `Session::record()`
-separately from its encrypted store. On `SessionTokensChanged`, obtain a new record from
-`ClientHandle::session_record()` and replace the saved record atomically in
-protected storage. Restore with the same store location and passphrase.
+with `sqlite` or `indexeddb`, a `SessionStore` holds one login's record and its
+store. `EncryptedSessionStore` seals the record with the store's passphrase, in a
+file you pick natively or an IndexedDB database beside the store in a browser.
+logging in saves the first record and `Session::restore` loads it. on every
+`SessionTokensChanged`, `save` a fresh `ClientHandle::session_record()` before
+the next refresh, refresh tokens only work once
 
 `Engine::run` resolves to a `Termination` saying why it stopped, and
 `Termination::retain` says what to do about it. after `LoggedOut` or
-`AccessRevoked` the record and the store are dead, bin them. `SoftLoggedOut`
-wants the store kept and a fresh login with `PasswordLogin::device_id` set to the
-device it carries, or the e2ee keys go with it. `ShutDown` and `HandlesDropped`
-keep everything. an `Err` is a real failure and kills nothing. one store
-directory per login, the sdk won't share a crypto store between devices.
-The headless example is
-login-only; it does not persist sessions across runs.
+`AccessRevoked` the record and the store are dead, `discard` them once the
+client is dropped, since an open store won't go quietly. `SoftLoggedOut` wants
+the record forgotten, the store kept and a fresh login with
+`PasswordLogin::device_id` set to the device it carries, or the e2ee keys go
+with it. `ShutDown` and `HandlesDropped` keep everything. an `Err` is a real
+failure and kills nothing. one store directory per login, the sdk won't share a
+crypto store between devices
 
 ## wasm
 

Modified file: docs/design-decisions.md+12 additions−5 deletions@@ -165,11 +165,18 @@ already sent and nothing says when that backlog is gone
 with an encrypted store, refresh tokens and threads. the store is sqlite
 natively and indexeddb in a browser. secret-bearing inputs don't derive `Clone`
 
-the caller owns the saved record. save `Session::record()` after login and
-replace it atomically with `ClientHandle::session_record()` on every
-`SessionTokensChanged`. logout and a hard rejection kill the record and the
-store. a soft logout keeps the store for a same-device login, or the e2ee keys
-go with it. a bare `Stopped` kills nothing. one store directory per login
+a `SessionStore` owns one login's record and its store. login saves the first
+record, `restore` loads it, and the caller saves `ClientHandle::session_record()`
+on every `SessionTokensChanged`. `EncryptedSessionStore` seals the record with
+the sdk's `StoreCipher` under the store's passphrase and replaces it by rename,
+so a crash mid save leaves the old one. it keeps the record out of the sdk's
+state store because sqlite writes custom values there in the clear, and a
+client can't open its store before it knows the homeserver the record holds.
+`discard` deletes the record, then the store, since a record without its store
+would restore into empty crypto. `forget` deletes only the record. the host
+follows `Termination::retain`, `Nothing` discards and `Store` forgets, keeping
+the store for a same-device login or the e2ee keys go with it. one store
+directory per login
 
 ## room lists, spaces and profiles
 

Modified file: examples/headless.rs+19 additions−17 deletions@@ -1,30 +1,30 @@
 use macltok::{
-    EngineConfig, Event, PasswordLogin, Retain, RoomMembership, Session, StoreConfig,
-    TimelineContent, TimelineDiff, TimelineId, TimelineItem, imbl::Vector,
+    EncryptedSessionStore, EngineConfig, Event, PasswordLogin, Retain, RoomMembership, Session,
+    SessionStore, StoreConfig, TimelineContent, TimelineDiff, TimelineId, TimelineItem,
+    imbl::Vector,
 };
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
     let store_path = std::path::PathBuf::from(required("MATRIX_STORE_PATH")?);
     let passphrase = required("MATRIX_STORE_PASSPHRASE")?;
-    // a real client keeps this somewhere safer, it holds the access token
-    let record_path = store_path.join("session.json");
-    let store = StoreConfig::sqlite(&store_path, &passphrase);
-    let session = match std::fs::read(&record_path) {
-        Ok(saved) => Session::restore(serde_json::from_slice(&saved)?, store).await?,
-        Err(_) => {
-            let session = Session::login_password(
+    let sessions = EncryptedSessionStore::file(
+        store_path.with_extension("session"),
+        StoreConfig::sqlite(&store_path, &passphrase),
+    );
+    let session = match Session::restore(&sessions).await? {
+        Some(session) => session,
+        None => {
+            Session::login_password(
                 PasswordLogin::new(
                     required("MATRIX_HOMESERVER")?,
                     required("MATRIX_USERNAME")?,
                     required("MATRIX_PASSWORD")?,
                 )
                 .with_device_display_name("macltok headless example"),
-                store,
+                &sessions,
             )
-            .await?;
-            std::fs::write(&record_path, serde_json::to_vec(&session.record())?)?;
-            session
+            .await?
         }
     };
     let (engine, handle, mut events) = session.build(EngineConfig::default()).await?;
@@ -75,7 +75,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                         print_messages(&items);
                     }
                     Event::SessionTokensChanged => {
-                        std::fs::write(&record_path, serde_json::to_vec(&handle.session_record()?)?)?;
+                        sessions.save(&handle.session_record()?).await?;
                     }
                     Event::Stopped => break,
                     _ => {}
@@ -88,10 +88,12 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
             }
         }
     }
-    match running.await??.retain() {
+    let termination = running.await??;
+    drop((handle, events));
+    match termination.retain() {
         Retain::RecordAndStore => {}
-        Retain::Store => std::fs::remove_file(&record_path)?,
-        Retain::Nothing => std::fs::remove_dir_all(&store_path)?,
+        Retain::Store => sessions.forget().await?,
+        Retain::Nothing => sessions.discard().await?,
     }
     Ok(())
 }

Modified file: src/account.rs+49 additions−28 deletions@@ -1,6 +1,6 @@
-use std::collections::HashMap;
 #[cfg(feature = "sqlite")]
 use std::path::PathBuf;
+use std::{collections::HashMap, sync::Arc};
 
 use matrix_sdk::{
     Client, ClientBuilder, SendOutsideWasm, SyncOutsideWasm, ThreadingSupport,
@@ -20,11 +20,12 @@ use serde::{Deserialize, Serialize};
 use thiserror::Error;
 use url::Url;
 
-use crate::{ClientHandle, Engine, EngineConfig, EngineError, EventStream, error::SourceError};
+use crate::{
+    ClientHandle, Engine, EngineConfig, EngineError, EventStream, SessionStore, error::SourceError,
+};
 
 pub struct Session {
     client: Client,
-    record: SessionRecord,
 }
 
 #[non_exhaustive]
@@ -125,6 +126,7 @@ pub enum OAuthApplicationType {
 
 pub struct PendingOAuthLogin {
     client: Client,
+    sessions: Arc<dyn SessionStore>,
     authorization_url: String,
     state: Option<CsrfToken>,
 }
@@ -162,7 +164,7 @@ impl PendingOAuthLogin {
             oauth.abort_login(&state).await;
             return Err(account_error("OAuth login", error));
         }
-        Session::from_client(self.client.clone())
+        Session::saved(self.client.clone(), &*self.sessions).await
     }
 
     pub async fn abort(mut self) {
@@ -212,11 +214,33 @@ impl StoreConfig {
         self.lock_holder = Some(holder.into());
         self
     }
+
+    /// delete the store's databases, once nothing has them open
+    pub async fn delete(&self) -> Result<(), AccountError> {
+        match &self.location {
+            #[cfg(feature = "sqlite")]
+            StoreLocation::Sqlite(path) => crate::session_store::delete_sqlite_store(path)
+                .map_err(|error| account_error("deleting the Matrix store", error)),
+            #[cfg(feature = "indexeddb")]
+            StoreLocation::IndexedDb(name) => crate::session_store::delete_indexeddb_store(name)
+                .await
+                .map_err(|error| account_error("deleting the Matrix store", error)),
+        }
+    }
+
+    pub(crate) fn passphrase(&self) -> &str {
+        &self.passphrase
+    }
+
+    #[cfg(feature = "indexeddb")]
+    pub(crate) fn indexeddb_name(&self) -> &str {
+        let StoreLocation::IndexedDb(name) = &self.location;
+        name
+    }
 }
 
-/// Serializable authentication secrets. Store this separately from the
-/// encrypted store in protected, preferably encrypted storage.
-/// A saved record must be replaced when `Event::SessionTokensChanged` arrives.
+/// Serializable authentication secrets. A `SessionStore` keeps it, and it must
+/// be replaced when `Event::SessionTokensChanged` arrives.
 #[derive(Clone, Deserialize, Serialize)]
 pub struct SessionRecord {
     homeserver: String,
@@ -261,9 +285,9 @@ pub enum AccountError {
 impl Session {
     pub async fn login_password(
         login: PasswordLogin,
-        store: StoreConfig,
+        sessions: &dyn SessionStore,
     ) -> Result<Self, AccountError> {
-        let client = matrix_client_builder(&store)
+        let client = matrix_client_builder(sessions.store())
             .server_name_or_homeserver_url(login.homeserver.trim())
             .build()
             .await
@@ -282,18 +306,18 @@ impl Session {
             .send()
             .await
             .map_err(|error| account_error("password login", error))?;
-        Self::from_client(client)
+        Self::saved(client, sessions).await
     }
 
     pub async fn begin_oauth(
         login: OAuthLogin,
-        store: StoreConfig,
+        sessions: Arc<dyn SessionStore>,
     ) -> Result<PendingOAuthLogin, AccountError> {
         let redirect_uri = Url::parse(login.redirect_uri.trim())
             .map_err(|error| account_error("parsing the OAuth redirect URI", error))?;
         let client_uri = Url::parse(login.client_uri.trim())
             .map_err(|error| account_error("parsing the OAuth client URI", error))?;
-        let client = matrix_client_builder(&store)
+        let client = matrix_client_builder(sessions.store())
             .server_name_or_homeserver_url(login.homeserver.trim())
             .build()
             .await
@@ -327,20 +351,24 @@ impl Session {
             .map_err(|error| account_error("starting OAuth login", error))?;
         Ok(PendingOAuthLogin {
             client,
+            sessions,
             authorization_url: authorization.url.to_string(),
             state: Some(authorization.state),
         })
     }
 
-    /// Restore a saved record with the same store location and passphrase.
+    /// Restore the record `sessions` holds, or `None` when it holds none.
     /// The caller must also handle refresh, rejection, and explicit logout.
-    pub async fn restore(record: SessionRecord, store: StoreConfig) -> Result<Self, AccountError> {
-        let client = matrix_client_builder(&store)
+    pub async fn restore(sessions: &dyn SessionStore) -> Result<Option<Self>, AccountError> {
+        let Some(record) = sessions.load().await? else {
+            return Ok(None);
+        };
+        let client = matrix_client_builder(sessions.store())
             .homeserver_url(&record.homeserver)
             .build()
             .await
             .map_err(|error| account_error("reopening the Matrix store", error))?;
-        let authentication = match record.authentication.clone() {
+        let authentication = match record.authentication {
             AuthenticationRecord::Matrix(session) => AuthSession::Matrix(session),
             AuthenticationRecord::OAuth { client_id, user } => {
                 OAuthSession { client_id, user }.into()
@@ -350,14 +378,7 @@ impl Session {
             .restore_session(authentication)
             .await
             .map_err(|error| account_error("restoring the authenticated session", error))?;
-        Ok(Self { client, record })
-    }
-
-    /// Initial login credentials only. This snapshot does not track later
-    /// token rotations; use `ClientHandle::session_record` after building.
-    #[must_use]
-    pub fn record(&self) -> SessionRecord {
-        self.record.clone()
+        Ok(Some(Self { client }))
     }
 
     pub async fn build(
@@ -369,9 +390,9 @@ impl Session {
             .map_err(AccountError::from)
     }
 
-    fn from_client(client: Client) -> Result<Self, AccountError> {
-        let record = session_record(&client)?;
-        Ok(Self { client, record })
+    async fn saved(client: Client, sessions: &dyn SessionStore) -> Result<Self, AccountError> {
+        sessions.save(&session_record(&client)?).await?;
+        Ok(Self { client })
     }
 }
 
@@ -416,7 +437,7 @@ fn matrix_client_builder(store: &StoreConfig) -> ClientBuilder {
     }
 }
 
-fn account_error(
+pub(crate) fn account_error(
     context: &'static str,
     source: impl std::error::Error + SendOutsideWasm + SyncOutsideWasm + 'static,
 ) -> AccountError {

Modified file: src/lib.rs+4 additions@@ -16,12 +16,16 @@ compile_error!("indexeddb only exists in a browser, use sqlite");
 
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 mod account;
+#[cfg(any(feature = "sqlite", feature = "indexeddb"))]
+mod session_store;
 
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 pub use account::{
     AccountError, OAuthApplicationType, OAuthLogin, PasswordLogin, PendingOAuthLogin, Session,
     SessionRecord, StoreConfig,
 };
+#[cfg(any(feature = "sqlite", feature = "indexeddb"))]
+pub use session_store::{EncryptedSessionStore, SessionStore};
 
 pub use engine::{Engine, EngineConfig, EngineError};
 pub use error::{Error, ErrorKind};

Added file: src/session_store.rs+356 additions@@ -0,0 +1,356 @@
+#[cfg(feature = "sqlite")]
+use std::path::{Path, PathBuf};
+
+use matrix_sdk::{BoxFuture, SendOutsideWasm, SyncOutsideWasm};
+use matrix_sdk_store_encryption::StoreCipher;
+use tokio::sync::Mutex;
+
+use crate::{AccountError, SessionRecord, StoreConfig, account::account_error};
+
+#[cfg(feature = "sqlite")]
+type RecordLocation = PathBuf;
+#[cfg(feature = "indexeddb")]
+type RecordLocation = String;
+
+/// one login's record and the matrix store it belongs to. the engine rotates refresh tokens
+/// and each works once, so a `save` has to land before the next refresh or the login is gone
+pub trait SessionStore: SendOutsideWasm + SyncOutsideWasm {
+    fn store(&self) -> &StoreConfig;
+
+    fn load(&self) -> BoxFuture<'_, Result<Option<SessionRecord>, AccountError>>;
+
+    /// replace the saved record, all or nothing
+    fn save<'a>(&'a self, record: &'a SessionRecord) -> BoxFuture<'a, Result<(), AccountError>>;
+
+    /// drop the record and keep the store, for `Retain::Store`
+    fn forget(&self) -> BoxFuture<'_, Result<(), AccountError>>;
+
+    /// drop the record and delete the store, once nothing has the store open
+    fn discard(&self) -> BoxFuture<'_, Result<(), AccountError>>;
+}
+
+/// keeps the record sealed with the store's passphrase, in a file natively and in an
+/// IndexedDB database of its own in a browser
+pub struct EncryptedSessionStore {
+    record: RecordLocation,
+    store: StoreConfig,
+    sealer: Mutex<Option<Sealer>>,
+}
+
+struct Sealer {
+    cipher: StoreCipher,
+    exported: Vec<u8>,
+}
+
+impl EncryptedSessionStore {
+    #[cfg(feature = "sqlite")]
+    #[must_use]
+    pub fn file(record: impl Into<PathBuf>, store: StoreConfig) -> Self {
+        Self::new(record.into(), store)
+    }
+
+    /// the record lives beside the store, in `<name>::macltok-session`
+    #[cfg(feature = "indexeddb")]
+    #[must_use]
+    pub fn indexeddb(store: StoreConfig) -> Self {
+        let record = format!("{}::macltok-session", store.indexeddb_name());
+        Self::new(record, store)
+    }
+
+    fn new(record: RecordLocation, store: StoreConfig) -> Self {
+        Self {
+            record,
+            store,
+            sealer: Mutex::new(None),
+        }
+    }
+
+    async fn load_record(&self) -> Result<Option<SessionRecord>, AccountError> {
+        let mut sealer = self.sealer.lock().await;
+        let Some(sealed) = backend::read(&self.record)
+            .await
+            .map_err(|error| account_error("reading the session record", error))?
+        else {
+            return Ok(None);
+        };
+        let (opened, record) = unseal(self.store.passphrase(), &sealed)?;
+        *sealer = Some(opened);
+        Ok(Some(record))
+    }
+
+    async fn save_record(&self, record: &SessionRecord) -> Result<(), AccountError> {
+        let mut sealer = self.sealer.lock().await;
+        let sealer = match &mut *sealer {
+            Some(sealer) => sealer,
+            empty => empty.insert(Sealer::new(self.store.passphrase())?),
+        };
+        let sealed = sealer.seal(record)?;
+        backend::write(&self.record, &sealed)
+            .await
+            .map_err(|error| account_error("writing the session record", error))
+    }
+
+    async fn forget_record(&self) -> Result<(), AccountError> {
+        let mut sealer = self.sealer.lock().await;
+        backend::remove(&self.record)
+            .await
+            .map_err(|error| account_error("removing the session record", error))?;
+        *sealer = None;
+        Ok(())
+    }
+
+    async fn discard_all(&self) -> Result<(), AccountError> {
+        self.forget_record().await?;
+        self.store.delete().await
+    }
+}
+
+impl SessionStore for EncryptedSessionStore {
+    fn store(&self) -> &StoreConfig {
+        &self.store
+    }
+
+    fn load(&self) -> BoxFuture<'_, Result<Option<SessionRecord>, AccountError>> {
+        Box::pin(self.load_record())
+    }
+
+    fn save<'a>(&'a self, record: &'a SessionRecord) -> BoxFuture<'a, Result<(), AccountError>> {
+        Box::pin(self.save_record(record))
+    }
+
+    fn forget(&self) -> BoxFuture<'_, Result<(), AccountError>> {
+        Box::pin(self.forget_record())
+    }
+
+    fn discard(&self) -> BoxFuture<'_, Result<(), AccountError>> {
+        Box::pin(self.discard_all())
+    }
+}
+
+impl Sealer {
+    fn new(passphrase: &str) -> Result<Self, AccountError> {
+        let cipher = StoreCipher::new()
+            .map_err(|error| account_error("creating the session record cipher", error))?;
+        let exported = cipher
+            .export(passphrase)
+            .map_err(|error| account_error("sealing the session record cipher", error))?;
+        Ok(Self { cipher, exported })
+    }
+
+    fn seal(&self, record: &SessionRecord) -> Result<Vec<u8>, AccountError> {
+        let value = self
+            .cipher
+            .encrypt_value(record)
+            .map_err(|error| account_error("sealing the session record", error))?;
+        let length = u32::try_from(self.exported.len())
+            .expect("an exported store cipher is a few hundred bytes");
+        let mut sealed = Vec::with_capacity(4 + self.exported.len() + value.len());
+        sealed.extend_from_slice(&length.to_be_bytes());
+        sealed.extend_from_slice(&self.exported);
+        sealed.extend_from_slice(&value);
+        Ok(sealed)
+    }
+}
+
+fn unseal(passphrase: &str, sealed: &[u8]) -> Result<(Sealer, SessionRecord), AccountError> {
+    let truncated = || {
+        account_error(
+            "opening the session record",
+            std::io::Error::from(std::io::ErrorKind::UnexpectedEof),
+        )
+    };
+    let (length, rest) = sealed.split_first_chunk::<4>().ok_or_else(truncated)?;
+    let (exported, value) = rest
+        .split_at_checked(u32::from_be_bytes(*length) as usize)
+        .ok_or_else(truncated)?;
+    let cipher = StoreCipher::import(passphrase, exported)
+        .map_err(|error| account_error("opening the session record cipher", error))?;
+    let record = cipher
+        .decrypt_value(value)
+        .map_err(|error| account_error("opening the session record", error))?;
+    let sealer = Sealer {
+        cipher,
+        exported: exported.to_vec(),
+    };
+    Ok((sealer, record))
+}
+
+#[cfg(feature = "sqlite")]
+mod backend {
+    use std::{
+        fs::{self, File, OpenOptions},
+        io::{self, ErrorKind, Write},
+        path::{Path, PathBuf},
+    };
+
+    pub(super) async fn read(path: &Path) -> io::Result<Option<Vec<u8>>> {
+        match fs::read(path) {
+            Ok(sealed) => Ok(Some(sealed)),
+            Err(error) if error.kind() == ErrorKind::NotFound => Ok(None),
+            Err(error) => Err(error),
+        }
+    }
+
+    pub(super) async fn write(path: &Path, sealed: &[u8]) -> io::Result<()> {
+        let mut temporary = path.as_os_str().to_owned();
+        temporary.push(".tmp");
+        let temporary = PathBuf::from(temporary);
+        let parent = match path.parent() {
+            Some(parent) if !parent.as_os_str().is_empty() => parent,
+            _ => Path::new("."),
+        };
+        fs::create_dir_all(parent)?;
+        let written = replace(path, &temporary, parent, sealed);
+        if written.is_err() {
+            let _ = fs::remove_file(&temporary);
+        }
+        written
+    }
+
+    fn replace(path: &Path, temporary: &Path, parent: &Path, sealed: &[u8]) -> io::Result<()> {
+        let mut file = private_file(temporary)?;
+        file.write_all(sealed)?;
+        file.sync_all()?;
+        fs::rename(temporary, path)?;
+        sync_directory(parent)
+    }
+
+    pub(super) async fn remove(path: &Path) -> io::Result<()> {
+        match fs::remove_file(path) {
+            Err(error) if error.kind() != ErrorKind::NotFound => Err(error),
+            _ => Ok(()),
+        }
+    }
+
+    #[cfg(unix)]
+    fn private_file(path: &Path) -> io::Result<File> {
+        use std::os::unix::fs::OpenOptionsExt;
+        OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .mode(0o600)
+            .open(path)
+    }
+
+    #[cfg(not(unix))]
+    fn private_file(path: &Path) -> io::Result<File> {
+        OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .open(path)
+    }
+
+    /// a rename isn't durable until its directory is synced
+    #[cfg(unix)]
+    fn sync_directory(path: &Path) -> io::Result<()> {
+        File::open(path)?.sync_all()
+    }
+
+    #[cfg(not(unix))]
+    fn sync_directory(_: &Path) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+#[cfg(feature = "indexeddb")]
+mod backend {
+    use indexed_db_futures::{
+        Build,
+        database::Database,
+        error::{Error, OpenDbError},
+        prelude::*,
+        transaction::{Transaction, TransactionMode},
+        typed_array::{Uint8Array, Uint8ArraySlice},
+    };
+
+    const RECORDS: &str = "records";
+    const KEY: &str = "record";
+
+    async fn open(name: &str) -> Result<Database, OpenDbError> {
+        Database::open(name)
+            .with_version(1u32)
+            .with_on_upgrade_needed(|_, transaction: &Transaction<'_>| -> Result<(), Error> {
+                transaction.db().create_object_store(RECORDS).build()?;
+                Ok(())
+            })
+            .build()?
+            .await
+    }
+
+    pub(super) async fn read(name: &str) -> Result<Option<Vec<u8>>, OpenDbError> {
+        let database = open(name).await?;
+        let sealed: Option<Uint8Array> = database
+            .transaction(RECORDS)
+            .with_mode(TransactionMode::Readonly)
+            .build()?
+            .object_store(RECORDS)?
+            .get(KEY)
+            .await?;
+        Ok(sealed.map(Into::into))
+    }
+
+    pub(super) async fn write(name: &str, sealed: &[u8]) -> Result<(), OpenDbError> {
+        let database = open(name).await?;
+        let transaction = database
+            .transaction(RECORDS)
+            .with_mode(TransactionMode::Readwrite)
+            .build()?;
+        transaction
+            .object_store(RECORDS)?
+            .put(Uint8ArraySlice::new(sealed))
+            .with_key(KEY)
+            .build()?;
+        Ok(transaction.commit().await?)
+    }
+
+    pub(super) async fn remove(name: &str) -> Result<(), OpenDbError> {
+        Ok(Database::delete_by_name(name)?.await?)
+    }
+}
+
+#[cfg(feature = "sqlite")]
+pub(crate) fn delete_sqlite_store(path: &Path) -> std::io::Result<()> {
+    use std::{fs, io::ErrorKind};
+
+    // matrix-sdk-sqlite 0.18's database names, which it keeps private
+    const DATABASES: [&str; 4] = [
+        "matrix-sdk-state.sqlite3",
+        "matrix-sdk-crypto.sqlite3",
+        "matrix-sdk-event-cache.sqlite3",
+        "matrix-sdk-media.sqlite3",
+    ];
+    for database in DATABASES {
+        for suffix in ["", "-wal", "-shm", "-journal"] {
+            match fs::remove_file(path.join(format!("{database}{suffix}"))) {
+                Err(error) if error.kind() != ErrorKind::NotFound => return Err(error),
+                _ => {}
+            }
+        }
+    }
+    match fs::remove_dir(path) {
+        Err(error) if error.kind() != ErrorKind::NotFound => Err(error),
+        _ => Ok(()),
+    }
+}
+
+#[cfg(feature = "indexeddb")]
+pub(crate) async fn delete_indexeddb_store(
+    name: &str,
+) -> Result<(), indexed_db_futures::error::OpenDbError> {
+    use indexed_db_futures::database::Database;
+
+    // the databases matrix-sdk-indexeddb 0.18 opens under one store name
+    for suffix in [
+        "",
+        "::matrix-sdk-state",
+        "::matrix-sdk-crypto",
+        "::matrix-sdk-crypto-meta",
+        "::event_cache",
+        "::media",
+    ] {
+        Database::delete_by_name(&format!("{name}{suffix}"))?.await?;
+    }
+    Ok(())
+}

Modified file: tests/account.rs+82 additions−22 deletions@@ -1,13 +1,16 @@
 #![cfg(feature = "sqlite")]
 mod support;
 
-use std::time::SystemTime;
+use std::{path::PathBuf, time::SystemTime};
 
-use macltok::{EngineConfig, Event, PasswordLogin, Session, SessionRecord, StoreConfig};
+use macltok::{
+    EncryptedSessionStore, EngineConfig, Event, PasswordLogin, Session, SessionRecord,
+    SessionStore, StoreConfig,
+};
 use matrix_sdk::{ruma::api::client::sync::sync_events::v5, test_utils::mocks::MatrixMockServer};
 
 #[tokio::test]
-async fn password_session_round_trips_through_an_encrypted_store() {
+async fn password_session_round_trips_and_discards_with_its_store() {
     let server = MatrixMockServer::new().await;
     server
         .mock_versions()
@@ -21,23 +24,23 @@ async fn password_session_round_trips_through_an_encrypted_store() {
         .ok(v5::Response::new("1".to_owned()))
         .mount()
         .await;
-    let store_path = temporary_store_path();
-    std::fs::create_dir_all(&store_path).unwrap();
+    let root = temporary_path();
+    let store_path = root.join("store");
+    let record_path = root.join("records").join("session");
+    let sessions = || {
+        EncryptedSessionStore::file(
+            &record_path,
+            StoreConfig::sqlite(&store_path, "test store passphrase"),
+        )
+    };
     let config = EngineConfig::default().with_initial_history_limit(0);
     let session = Session::login_password(
         PasswordLogin::new(server.uri(), "example", "wordpass")
             .with_device_display_name("macltok test"),
-        StoreConfig::sqlite(&store_path, "test store passphrase"),
+        &sessions(),
     )
     .await
     .unwrap();
-    let encoded = serde_json::to_vec(&session.record()).unwrap();
-    let record: SessionRecord = serde_json::from_slice(&encoded).unwrap();
-    assert_eq!(
-        record.homeserver().trim_end_matches('/'),
-        server.uri().trim_end_matches('/')
-    );
-
     let (engine, handle, mut events) = session.build(config.clone()).await.unwrap();
     let running = tokio::spawn(engine.run());
     support::receive_until(&mut events, |event| {
@@ -45,13 +48,16 @@ async fn password_session_round_trips_through_an_encrypted_store() {
     })
     .await;
     support::shut_down(&handle, &mut events, running).await;
+    drop(handle);
 
-    let session = Session::restore(
-        record,
-        StoreConfig::sqlite(&store_path, "test store passphrase"),
-    )
-    .await
-    .unwrap();
+    let wrong = EncryptedSessionStore::file(
+        &record_path,
+        StoreConfig::sqlite(&store_path, "someone else's passphrase"),
+    );
+    assert!(wrong.load().await.is_err());
+
+    let sessions = sessions();
+    let session = Session::restore(&sessions).await.unwrap().unwrap();
     let (engine, handle, mut events) = session.build(config).await.unwrap();
     let running = tokio::spawn(engine.run());
     support::receive_until(&mut events, |event| {
@@ -59,14 +65,68 @@ async fn password_session_round_trips_through_an_encrypted_store() {
     })
     .await;
     support::shut_down(&handle, &mut events, running).await;
+    drop(handle);
+
+    sessions.discard().await.unwrap();
+    assert!(!record_path.exists());
+    assert!(!store_path.exists());
+    assert!(Session::restore(&sessions).await.unwrap().is_none());
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+#[tokio::test]
+async fn a_torn_or_failed_save_leaves_the_old_record() {
+    let root = temporary_path();
+    let record_path = root.join("session");
+    let sessions = || {
+        EncryptedSessionStore::file(
+            &record_path,
+            StoreConfig::sqlite(root.join("store"), "test store passphrase"),
+        )
+    };
+    let temporary = root.join("session.tmp");
+    sessions()
+        .save(&record("https://old.example"))
+        .await
+        .unwrap();
+
+    std::fs::write(&temporary, b"half a rec").unwrap();
+    let loaded = sessions().load().await.unwrap().unwrap();
+    assert_eq!(loaded.homeserver(), "https://old.example");
+
+    std::fs::remove_file(&temporary).unwrap();
+    std::fs::create_dir(&temporary).unwrap();
+    assert!(
+        sessions()
+            .save(&record("https://new.example"))
+            .await
+            .is_err()
+    );
+    let loaded = sessions().load().await.unwrap().unwrap();
+    assert_eq!(loaded.homeserver(), "https://old.example");
+
+    std::fs::remove_dir_all(root).unwrap();
+}
 
-    std::fs::remove_dir_all(store_path).unwrap();
+fn record(homeserver: &str) -> SessionRecord {
+    serde_json::from_value(serde_json::json!({
+        "homeserver": homeserver,
+        "authentication": {
+            "type": "matrix",
+            "session": {
+                "user_id": "@example:example.org",
+                "device_id": "DEVICE",
+                "access_token": "secret",
+            },
+        },
+    }))
+    .unwrap()
 }
 
-fn temporary_store_path() -> std::path::PathBuf {
+fn temporary_path() -> PathBuf {
     let nonce = SystemTime::now()
         .duration_since(SystemTime::UNIX_EPOCH)
         .unwrap()
         .as_nanos();
-    std::env::temp_dir().join(format!("macltok-account-{nonce}"))
+    PathBuf::from(env!("CARGO_TARGET_TMPDIR")).join(format!("macltok-account-{nonce}"))
 }

macltok

Commit 713205a95af2

Commit `713205a95af2`