macltok

public

Star0

Fork 0

Watch0

26 commits 3 branches 0 tags 0 releases3.0 MiB

Commit `a250c7fa43fb`

tarball

atagen <boss@atagen.co>2026-09-27 01:42 UTC

9 files changed+360-33

account: allow one engine per store, and keep the login when the first save fails

The store is held by a platform lock, a flock on macltok.lock natively and a Web Lock in a browser, because matrix-sdk 0.18's lease abandons its renewal silently after one failed write or a 500ms stall and would hand a live store to a second engine. A login whose first record save fails hands its session back as AccountError::Unsaved, since the server already has the device and logging in again would spend another.

Modified file: README.md+7 additions−2 deletions@@ -126,8 +126,13 @@ what's different in a browser
   has no upload progress
 - the sdk doesn't retry requests or time them out individually. sync still
   restarts itself with backoff, that part is ours
-- two tabs or workers on one store each need `StoreConfig::with_lock_holder`
-  with a name of their own, or they both think they hold the crypto store
+- an OAuth login only finishes in the process that began it, since the sdk
+  keeps its pending state in memory. run it in a popup, or in a worker that
+  outlives the redirect, not by navigating the page away
+- one engine per store. a second tab or worker opening a store that's in use
+  gets `StoreInUse` straight away, so serve many tabs from one engine in a
+  SharedWorker rather than one each. the store's Web Lock needs a secure
+  context
 - `discard` while another tab still has the store open answers
   `StoreDeletePending`. the delete lands once that tab lets go, and reopening
   the store waits behind it

Modified file: docs/design-decisions.md+37 additions−1 deletions@@ -222,7 +222,43 @@ would restore into empty crypto. the host follows `Termination::retain`.
 swaps the record for one holding the homeserver, user, device and oauth client
 id with no tokens. `restore` hands that back as `Restore::SoftLoggedOut`, so a
 restart still knows which device to log in again as, and the login overwrites
-it. one store directory per login
+it. one store directory per login. a login whose first save fails comes back as
+`AccountError::Unsaved` holding the live session, so the host retries the save
+rather than spending another device
+
+one engine per store. before the client opens the store we take the platform's
+own exclusive lock on it, `File::try_lock` on `macltok.lock` in the store
+directory natively and a Web Lock named after the store in a browser. the
+engine and every `ClientHandle` share it, so it goes when the last of them
+does, since a lingering handle still has the client and its store open. anyone
+else, in this process, another one or another tab, gets `StoreInUse` at once,
+so the host decides whether to wait, hand over or say so. the os or the browser
+lets go when the holder dies. a SharedWorker serving every tab from one engine
+never contends for it. Web Locks only exist in a secure context, so a browser
+store needs one too
+
+the sdk's cross process lease can't do this job. in matrix-sdk-common 0.18
+`CrossProcessLock::try_lock_once` (`cross_process_lock.rs` 389-448) leases for
+500ms and renews every 50ms from a spawned task, which gives up for good on one
+failed renewal or on finding the lease lapsed and retaken, and tells no one. a
+stall past half a second, ordinary in a tab and certain during the record's
+PBKDF2, or one `SQLITE_BUSY`, hands the store to a second engine while the
+first still thinks it's alone. with our lock keeping everyone else out, clients
+run with `CrossProcessLockConfig::SingleProcess` and the sdk's own sections skip
+the lease writes and renewal tasks
+
+a pending OAuth login isn't persisted. `begin_oauth` and `finish` have to run in
+the same process, so a web host runs the login in a popup or in a worker that
+outlives the redirect. the sdk keeps what `finish_login` needs, the PKCE
+verifier among it, in `AuthorizationValidationData` inside a `pub(crate)` map
+keyed by `CsrfToken` (matrix-sdk 0.18, `authentication/oauth/mod.rs` around
+262-266 and 1744-1756). nothing public reads it or puts it back, and
+`finish_login` on a fresh client answers `InvalidState`. doing the code grant
+ourselves would copy some 250 lines of the sdk's private oauth behaviour and
+drift from it every upgrade. patching the sdk to export and import that data is
+small, but it means carrying a matrix-sdk fork, which we won't for now. upstream
+exposing export and import of pending authorization data, or a fork becoming
+acceptable, reopens this
 
 ## room lists, spaces and profiles
 

Modified file: src/account.rs+98 additions−25 deletions@@ -26,7 +26,8 @@ use url::Url;
 
 use crate::{
     ClientHandle, Engine, EngineConfig, EngineError, ErrorKind, EventStream, SessionStore,
-    engine::Persistence, error::SourceError,
+    engine::{Persistence, StoreLock},
+    error::SourceError,
 };
 
 /// a logged in client and the `SessionStore` its record lives in. the engine it builds
@@ -34,6 +35,7 @@ use crate::{
 pub struct Session {
     client: Client,
     tracking: Tracking,
+    store_lock: StoreLock,
 }
 
 /// taken as soon as the client exists, since the sdk can refresh before there's an engine
@@ -143,7 +145,7 @@ pub enum OAuthApplicationType {
 pub struct PendingOAuthLogin {
     client: Client,
     sessions: Arc<dyn SessionStore>,
-    tracking: Option<Tracking>,
+    tracking: Option<(Tracking, StoreLock)>,
     authorization_url: String,
     state: Option<CsrfToken>,
 }
@@ -181,11 +183,17 @@ impl PendingOAuthLogin {
             oauth.abort_login(&state).await;
             return Err(account_error("OAuth login", error));
         }
-        let tracking = self
+        let (tracking, store_lock) = self
             .tracking
             .take()
             .ok_or(AccountError::OAuthCallbackAlreadySubmitted)?;
-        Session::saved(self.client.clone(), &*self.sessions, tracking).await
+        Session::saved(
+            self.client.clone(),
+            self.sessions.clone(),
+            tracking,
+            store_lock,
+        )
+        .await
     }
 
     pub async fn abort(mut self) {
@@ -198,7 +206,6 @@ impl PendingOAuthLogin {
 pub struct StoreConfig {
     location: StoreLocation,
     passphrase: String,
-    lock_holder: Option<String>,
 }
 
 enum StoreLocation {
@@ -215,7 +222,6 @@ impl StoreConfig {
         Self {
             location: StoreLocation::Sqlite(path.into()),
             passphrase: passphrase.into(),
-            lock_holder: None,
         }
     }
 
@@ -225,17 +231,9 @@ impl StoreConfig {
         Self {
             location: StoreLocation::IndexedDb(name.into()),
             passphrase: passphrase.into(),
-            lock_holder: None,
         }
     }
 
-    /// the sdk names every client `main`, so two tabs on one store would both think they hold its lock
-    #[must_use]
-    pub fn with_lock_holder(mut self, holder: impl Into<String>) -> Self {
-        self.lock_holder = Some(holder.into());
-        self
-    }
-
     /// delete the store's databases, once nothing has them open
     pub async fn delete(&self) -> Result<(), AccountError> {
         match &self.location {
@@ -249,6 +247,17 @@ impl StoreConfig {
         }
     }
 
+    /// taken before the client opens the store, and held until the engine and every
+    /// `ClientHandle` are gone
+    pub(crate) async fn lock(&self) -> Result<StoreLock, AccountError> {
+        match &self.location {
+            #[cfg(feature = "sqlite")]
+            StoreLocation::Sqlite(path) => StoreLock::file(path),
+            #[cfg(feature = "indexeddb")]
+            StoreLocation::IndexedDb(name) => StoreLock::web(name).await,
+        }
+    }
+
     pub(crate) fn passphrase(&self) -> &str {
         &self.passphrase
     }
@@ -352,15 +361,62 @@ pub enum AccountError {
     /// once they close, and opening the store again waits behind it
     #[error("the store is still open elsewhere, it will be deleted once that closes")]
     StoreDeletePending,
+    /// another engine, in this process or another, has the store. only one runs per store
+    #[error("another engine is using this store")]
+    StoreInUse,
+    /// the login worked but its first record didn't save. the server already has the
+    /// device, so retry the save rather than log in again
+    #[error("saving the new login's record failed")]
+    Unsaved {
+        session: Box<UnsavedSession>,
+        #[source]
+        source: Box<AccountError>,
+    },
     #[error(transparent)]
     Engine(#[from] EngineError),
 }
 
+/// a live login whose record never reached its `SessionStore`
+pub struct UnsavedSession {
+    session: Session,
+    sessions: Arc<dyn SessionStore>,
+}
+
+impl UnsavedSession {
+    pub async fn save(self) -> Result<Session, AccountError> {
+        let saved = match session_record(&self.session.client) {
+            Ok(record) => self.sessions.save(&record).await,
+            Err(error) => Err(error),
+        };
+        match saved {
+            Ok(()) => Ok(self.session),
+            Err(source) => Err(AccountError::Unsaved {
+                session: Box::new(self),
+                source: Box::new(source),
+            }),
+        }
+    }
+
+    /// the record to keep somewhere else, if the store won't take it
+    pub fn record(&self) -> Result<SessionRecord, AccountError> {
+        session_record(&self.session.client)
+    }
+}
+
+impl std::fmt::Debug for UnsavedSession {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("UnsavedSession")
+            .finish_non_exhaustive()
+    }
+}
+
 impl Session {
     pub async fn login_password(
         login: PasswordLogin,
         sessions: Arc<dyn SessionStore>,
     ) -> Result<Self, AccountError> {
+        let store_lock = sessions.store().lock().await?;
         let client = matrix_client_builder(sessions.store())
             .server_name_or_homeserver_url(login.homeserver.trim())
             .build()
@@ -381,9 +437,10 @@ impl Session {
             .send()
             .await
             .map_err(|error| account_error("password login", error))?;
-        Self::saved(client, &*sessions, tracking).await
+        Self::saved(client, sessions, tracking, store_lock).await
     }
 
+    /// the pending login lives only in this process, so the one that begins it has to finish it
     pub async fn begin_oauth(
         login: OAuthLogin,
         sessions: Arc<dyn SessionStore>,
@@ -392,6 +449,7 @@ impl Session {
             .map_err(|error| account_error("parsing the OAuth redirect URI", error))?;
         let client_uri = Url::parse(login.client_uri.trim())
             .map_err(|error| account_error("parsing the OAuth client URI", error))?;
+        let store_lock = sessions.store().lock().await?;
         let client = matrix_client_builder(sessions.store())
             .server_name_or_homeserver_url(login.homeserver.trim())
             .build()
@@ -428,7 +486,7 @@ impl Session {
         Ok(PendingOAuthLogin {
             client,
             sessions,
-            tracking: Some(tracking),
+            tracking: Some((tracking, store_lock)),
             authorization_url: authorization.url.to_string(),
             state: Some(authorization.state),
         })
@@ -454,6 +512,7 @@ impl Session {
                 })));
             }
         };
+        let store_lock = sessions.store().lock().await?;
         let client = matrix_client_builder(sessions.store())
             .homeserver_url(&record.homeserver)
             .build()
@@ -464,7 +523,11 @@ impl Session {
             .restore_session(authentication)
             .await
             .map_err(|error| account_error("restoring the authenticated session", error))?;
-        Ok(Some(Restore::Resumed(Self { client, tracking })))
+        Ok(Some(Restore::Resumed(Self {
+            client,
+            tracking,
+            store_lock,
+        })))
     }
 
     /// leave the record to the host, which then saves `ClientHandle::session_record()`
@@ -486,6 +549,7 @@ impl Session {
             config,
             self.tracking.session_changes,
             self.tracking.persistence,
+            Some(self.store_lock),
         )
         .await
         .map_err(AccountError::from)
@@ -493,11 +557,20 @@ impl Session {
 
     async fn saved(
         client: Client,
-        sessions: &dyn SessionStore,
+        sessions: Arc<dyn SessionStore>,
         tracking: Tracking,
+        store_lock: StoreLock,
     ) -> Result<Self, AccountError> {
-        sessions.save(&session_record(&client)?).await?;
-        Ok(Self { client, tracking })
+        UnsavedSession {
+            session: Self {
+                client,
+                tracking,
+                store_lock,
+            },
+            sessions,
+        }
+        .save()
+        .await
     }
 }
 
@@ -587,16 +660,16 @@ fn encryption_settings() -> EncryptionSettings {
     }
 }
 
+/// `StoreLock` already keeps every other client off the store, and the sdk's lease would cost
+/// a store write per locked section and a task renewing it every 50ms
 fn matrix_client_builder(store: &StoreConfig) -> ClientBuilder {
-    let mut builder = Client::builder()
+    let builder = Client::builder()
         .with_encryption_settings(encryption_settings())
         .with_threading_support(ThreadingSupport::Enabled {
             with_subscriptions: false,
         })
-        .handle_refresh_tokens();
-    if let Some(holder) = &store.lock_holder {
-        builder = builder.cross_process_store_config(CrossProcessLockConfig::multi_process(holder));
-    }
+        .handle_refresh_tokens()
+        .cross_process_store_config(CrossProcessLockConfig::SingleProcess);
     match &store.location {
         #[cfg(feature = "sqlite")]
         StoreLocation::Sqlite(path) => builder.sqlite_store(path, Some(&store.passphrase)),

Modified file: src/engine/mod.rs+12 additions−1 deletions@@ -25,6 +25,11 @@ use tokio::sync::{broadcast, mpsc, watch};
 pub(crate) use media::MediaService;
 pub(crate) use session::Persistence;
 
+#[cfg(any(feature = "sqlite", feature = "indexeddb"))]
+pub(crate) use crate::store_lock::StoreLock;
+#[cfg(not(any(feature = "sqlite", feature = "indexeddb")))]
+pub(crate) enum StoreLock {}
+
 use self::{
     commands::Job,
     executor::{EngineBoxFuture, TaskSet},
@@ -273,6 +278,8 @@ pub struct Engine {
     stops: mpsc::UnboundedReceiver<Termination>,
     logouts: Arc<watch::Sender<Logouts>>,
     preparations: prepare::Preparations,
+    /// shared with every `ClientHandle`, so the store stays locked while the client is reachable
+    _store_lock: Option<Arc<StoreLock>>,
 }
 
 impl Engine {
@@ -282,7 +289,7 @@ impl Engine {
         config: EngineConfig,
     ) -> Result<(Self, ClientHandle, EventStream), EngineError> {
         let session_changes = client.subscribe_to_session_changes();
-        Self::with_persistence(client, config, session_changes, None).await
+        Self::with_persistence(client, config, session_changes, None, None).await
     }
 
     /// `session_changes` is taken when the client is built, since the sdk can refresh
@@ -292,6 +299,7 @@ impl Engine {
         config: EngineConfig,
         session_changes: broadcast::Receiver<SessionChange>,
         persistence: Option<Persistence>,
+        store_lock: Option<StoreLock>,
     ) -> Result<(Self, ClientHandle, EventStream), EngineError> {
         if client.user_id().is_none() {
             return Err(EngineError::Unauthenticated);
@@ -309,6 +317,7 @@ impl Engine {
                 .await
                 .map_err(EngineError::SyncService)?,
         );
+        let store_lock = store_lock.map(Arc::new);
         let media = Arc::new(MediaService::new(
             client.clone(),
             config.max_media_bytes,
@@ -318,6 +327,7 @@ impl Engine {
             client.clone(),
             sync.clone(),
             media.clone(),
+            store_lock.clone(),
             config.command_capacity,
             config.event_capacity,
         );
@@ -360,6 +370,7 @@ impl Engine {
             stop,
             stops,
             logouts: Arc::new(watch::Sender::new(Logouts::default())),
+            _store_lock: store_lock,
         };
         Ok((engine, handle, events))
     }

Modified file: src/lib.rs+3 additions−1 deletions@@ -22,11 +22,13 @@ compile_error!("indexeddb only exists in a browser, use sqlite");
 mod account;
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 mod session_store;
+#[cfg(any(feature = "sqlite", feature = "indexeddb"))]
+mod store_lock;
 
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 pub use account::{
     AccountError, OAuthApplicationType, OAuthLogin, PasswordLogin, PendingOAuthLogin, Restore,
-    Session, SessionRecord, SoftLogout, StoreConfig,
+    Session, SessionRecord, SoftLogout, StoreConfig, UnsavedSession,
 };
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 pub use session_store::{EncryptedSessionStore, SessionStore};

Modified file: src/session_store.rs+4 additions@@ -487,6 +487,10 @@ pub(crate) fn delete_sqlite_store(path: &Path) -> std::io::Result<()> {
             }
         }
     }
+    match fs::remove_file(path.join(crate::store_lock::LOCK_FILE)) {
+        Err(error) if error.kind() != ErrorKind::NotFound => return Err(error),
+        _ => {}
+    }
     match fs::remove_dir(path) {
         Err(error) if error.kind() != ErrorKind::NotFound => Err(error),
         _ => Ok(()),

Added file: src/store_lock.rs+117 additions@@ -0,0 +1,117 @@
+use crate::{AccountError, account::account_error};
+
+/// the platform's own exclusive lock on a store. matrix-sdk 0.18's cross process lease drops
+/// itself silently after one failed renewal or a stall past 500ms, so it can't be what keeps a
+/// second engine out
+pub(crate) struct StoreLock {
+    #[cfg(feature = "sqlite")]
+    _file: std::fs::File,
+    #[cfg(feature = "indexeddb")]
+    release: js_sys::Function,
+}
+
+#[cfg(feature = "sqlite")]
+pub(crate) const LOCK_FILE: &str = "macltok.lock";
+
+#[cfg(feature = "sqlite")]
+impl StoreLock {
+    pub(crate) fn file(directory: &std::path::Path) -> Result<Self, AccountError> {
+        use std::fs::{self, File, TryLockError};
+
+        fs::create_dir_all(directory)
+            .map_err(|error| account_error("creating the Matrix store directory", error))?;
+        let file = File::options()
+            .create(true)
+            .truncate(false)
+            .write(true)
+            .open(directory.join(LOCK_FILE))
+            .map_err(|error| account_error("opening the Matrix store's lock file", error))?;
+        match file.try_lock() {
+            Ok(()) => Ok(Self { _file: file }),
+            Err(TryLockError::WouldBlock) => Err(AccountError::StoreInUse),
+            Err(TryLockError::Error(error)) => {
+                Err(account_error("locking the Matrix store", error))
+            }
+        }
+    }
+}
+
+#[cfg(feature = "indexeddb")]
+#[derive(Debug, thiserror::Error)]
+enum WebLockError {
+    #[error("this global scope has no Web Locks, they need a secure context")]
+    Unavailable,
+    #[error("requesting the Web Lock failed, {0}")]
+    Failed(String),
+}
+
+#[cfg(feature = "indexeddb")]
+impl StoreLock {
+    /// `ifAvailable` answers at once. the lock is ours until the promise we hand back settles
+    pub(crate) async fn web(name: &str) -> Result<Self, AccountError> {
+        use futures_util::future::{Either, select};
+        use js_sys::{Function, Object, Promise, Reflect};
+        use tokio::sync::oneshot;
+        use wasm_bindgen::{JsCast, JsValue, closure::Closure};
+
+        let failed = |error: JsValue| {
+            account_error(
+                "locking the Matrix store",
+                WebLockError::Failed(format!("{error:?}")),
+            )
+        };
+        let locks = Reflect::get(&js_sys::global(), &JsValue::from_str("navigator"))
+            .and_then(|navigator| Reflect::get(&navigator, &JsValue::from_str("locks")))
+            .map_err(failed)?;
+        if locks.is_undefined() {
+            return Err(account_error(
+                "locking the Matrix store",
+                WebLockError::Unavailable,
+            ));
+        }
+        let request: Function = Reflect::get(&locks, &JsValue::from_str("request"))
+            .map_err(failed)?
+            .dyn_into()
+            .map_err(failed)?;
+        let options = Object::new();
+        Reflect::set(&options, &JsValue::from_str("ifAvailable"), &JsValue::TRUE)
+            .map_err(failed)?;
+
+        let (granted, grant) = oneshot::channel();
+        let callback = Closure::once(move |lock: JsValue| -> JsValue {
+            if lock.is_null() {
+                let _ = granted.send(None);
+                return JsValue::UNDEFINED;
+            }
+            let mut release = None;
+            let held = Promise::new(&mut |resolve, _| release = Some(resolve));
+            let _ = granted.send(release);
+            held.into()
+        });
+        let outcome: Promise = request
+            .call3(
+                &locks,
+                &JsValue::from_str(&format!("macltok:{name}")),
+                &options,
+                callback.as_ref(),
+            )
+            .map_err(failed)?
+            .dyn_into()
+            .map_err(failed)?;
+        match select(grant, wasm_bindgen_futures::JsFuture::from(outcome)).await {
+            Either::Left((Ok(Some(release)), _)) => Ok(Self { release }),
+            Either::Left((Ok(None), _)) => Err(AccountError::StoreInUse),
+            Either::Left((Err(_), _)) | Either::Right((Ok(_), _)) => {
+                Err(failed(JsValue::from_str("the lock callback never ran")))
+            }
+            Either::Right((Err(error), _)) => Err(failed(error)),
+        }
+    }
+}
+
+#[cfg(feature = "indexeddb")]
+impl Drop for StoreLock {
+    fn drop(&mut self) {
+        let _ = self.release.call0(&wasm_bindgen::JsValue::UNDEFINED);
+    }
+}

Modified file: src/transport.rs+4 additions−1 deletions@@ -35,7 +35,7 @@ use crate::{
     RoomNotificationSettings, RoomPowerLevels, RoomSummary, SpaceChild, TimelineCommand,
     TimelineId, VerificationAction, VerificationTarget,
     encryption::encryption_state,
-    engine::MediaService,
+    engine::{MediaService, StoreLock},
     model::{PushNotificationRoom, PushNotificationSender},
     normalise::{member_summary, room_summaries, space_child},
 };
@@ -49,6 +49,7 @@ pub struct ClientHandle {
     sync_service: Arc<SyncService>,
     media: Arc<MediaService>,
     spaces: Arc<OnceCell<SpaceService>>,
+    _store_lock: Option<Arc<StoreLock>>,
 }
 
 impl fmt::Debug for ClientHandle {
@@ -1006,6 +1007,7 @@ pub(crate) fn transport_pair(
     client: Client,
     sync_service: Arc<SyncService>,
     media: Arc<MediaService>,
+    store_lock: Option<Arc<StoreLock>>,
     command_capacity: usize,
     event_capacity: usize,
 ) -> (ClientHandle, DriverPort, EventStream) {
@@ -1021,6 +1023,7 @@ pub(crate) fn transport_pair(
             sync_service,
             media,
             spaces: Arc::new(OnceCell::new()),
+            _store_lock: store_lock,
         },
         DriverPort {
             requests: request_rx,

Modified file: tests/account.rs+78 additions−2 deletions@@ -4,8 +4,8 @@ mod support;
 use std::{path::PathBuf, sync::Arc, time::SystemTime};
 
 use macltok::{
-    EncryptedSessionStore, EngineConfig, Event, PasswordLogin, Restore, Session, SessionRecord,
-    SessionStore, StoreConfig,
+    AccountError, EncryptedSessionStore, EngineConfig, Event, PasswordLogin, Restore, Session,
+    SessionRecord, SessionStore, StoreConfig,
 };
 use matrix_sdk::{ruma::api::client::sync::sync_events::v5, test_utils::mocks::MatrixMockServer};
 
@@ -121,6 +121,82 @@ async fn a_restart_after_a_soft_logout_still_knows_the_device() {
 }
 
 #[tokio::test]
+async fn a_login_whose_first_save_fails_can_still_be_saved() {
+    let server = MatrixMockServer::new().await;
+    server.mock_versions().ok().mount().await;
+    server.mock_login().ok().mount().await;
+    let root = temporary_path();
+    let records = root.join("records");
+    std::fs::create_dir_all(&records).unwrap();
+    let sessions = || {
+        EncryptedSessionStore::file(
+            records.join("session"),
+            StoreConfig::sqlite(root.join("store"), "test store passphrase"),
+        )
+    };
+    let writable = std::fs::metadata(&records).unwrap().permissions();
+    let mut read_only = writable.clone();
+    read_only.set_readonly(true);
+    std::fs::set_permissions(&records, read_only).unwrap();
+
+    let login = Session::login_password(
+        PasswordLogin::new(server.uri(), "example", "wordpass"),
+        Arc::new(sessions()),
+    )
+    .await;
+    let Err(AccountError::Unsaved { session, .. }) = login else {
+        panic!("a login that couldn't save its record didn't hand the session back");
+    };
+    std::fs::set_permissions(&records, writable).unwrap();
+    drop(session.save().await.unwrap());
+    assert!(matches!(
+        Session::restore(Arc::new(sessions())).await.unwrap(),
+        Some(Restore::Resumed(_))
+    ));
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+#[tokio::test]
+async fn a_store_takes_one_session_at_a_time() {
+    let server = MatrixMockServer::new().await;
+    server.mock_versions().ok().mount().await;
+    server.mock_login().ok().mount().await;
+    let root = temporary_path();
+    let sessions = || {
+        EncryptedSessionStore::file(
+            root.join("session"),
+            StoreConfig::sqlite(root.join("store"), "test store passphrase"),
+        )
+    };
+    let (engine, handle, events) = Session::login_password(
+        PasswordLogin::new(server.uri(), "example", "wordpass"),
+        Arc::new(sessions()),
+    )
+    .await
+    .unwrap()
+    .build(EngineConfig::default())
+    .await
+    .unwrap();
+
+    assert!(matches!(
+        Session::restore(Arc::new(sessions())).await,
+        Err(AccountError::StoreInUse)
+    ));
+    drop((engine, events));
+    assert!(matches!(
+        Session::restore(Arc::new(sessions())).await,
+        Err(AccountError::StoreInUse)
+    ));
+    drop(handle);
+    let resumed = Session::restore(Arc::new(sessions())).await.unwrap();
+    assert!(matches!(resumed, Some(Restore::Resumed(_))));
+    drop(resumed);
+    sessions().discard().await.unwrap();
+    assert!(!root.join("store").exists());
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+#[tokio::test]
 async fn a_torn_or_failed_save_leaves_the_old_record() {
     let root = temporary_path();
     let record_path = root.join("session");

macltok

Commit a250c7fa43fb

Commit `a250c7fa43fb`