macltok

public

Star0

Fork 0

Watch0

34 commits 3 branches 0 tags 0 releases3.0 MiB

Commit `cb0668d30c14`

tarball

atagen <boss@atagen.co>2026-10-08 13:08 UTC

6 files changed+588-5

accounts: keep every account an owner has, and resume a soft logout by itself

Modified file: README.md+5 additions@@ -78,6 +78,11 @@ nothing, and the login overwrites it with a live record. `ShutDown` and
 one store directory per login, the sdk won't share a crypto store between
 devices
 
+`Accounts` does that bookkeeping. it holds one person's accounts under one root,
+`login_password` and `begin_oauth` pick the store, resuming a soft-logged-out
+device when the login names it, and `list` hands back an `Account` each to
+`restore` and to apply `Termination::retain` through `sessions`
+
 ## The mirror
 
 the loop above is easy to get subtly wrong, so the `mirror` feature ships one.

Modified file: docs/design-decisions.md+18 additions@@ -254,6 +254,24 @@ it. one store directory per login. a login whose first save fails comes back as
 `AccountError::Unsaved` holding the live session, so the host retries the save
 rather than spending another device
 
+`Accounts` picks the store, so a host never decides which account a login form
+means. it's one owner's accounts under one root and one passphrase, a store and
+record each, named by a random id. a password login that names a
+soft-logged-out account, by localpart or full user id on the same server, logs
+back in as that device into that store. the server is compared by name as well
+as by url, since a typed `example.org` is stored as wherever discovery led. a
+live account it names is `AlreadyLoggedIn`, anyone else gets a new store. oauth
+can't know who it's for until it finishes, so it resumes only the device
+`SoftLogout::oauth_login` names. a new store is locked before it's listed, so
+`list` can sweep stores with no record, left by a login that died or a discard
+that didn't finish, without catching one mid login. a browser lists accounts in
+an IndexedDB database of their own, a key each, so two tabs adding at once
+don't lose one
+
+the set is per owner because resuming needs only the password, and the store
+holds the device's e2ee keys. a set shared across people would hand someone who
+knows a password the history a fresh login wouldn't get
+
 one engine per store. before the client opens the store we take the platform's
 own exclusive lock on it, `File::try_lock` on `macltok.lock` in the store
 directory natively and a Web Lock named after the store in a browser. the

Modified file: src/account.rs+70 additions−3 deletions@@ -316,6 +316,28 @@ impl SessionRecord {
         &self.homeserver
     }
 
+    pub(crate) fn user_id(&self) -> &OwnedUserId {
+        match &self.authentication {
+            AuthenticationRecord::Matrix(session) => &session.meta.user_id,
+            AuthenticationRecord::OAuth { user, .. } => &user.meta.user_id,
+            AuthenticationRecord::SoftLoggedOut { meta, .. } => &meta.user_id,
+        }
+    }
+
+    pub(crate) fn soft_logout(&self) -> Option<SoftLogout> {
+        let AuthenticationRecord::SoftLoggedOut { meta, client_id } = &self.authentication else {
+            return None;
+        };
+        Some(SoftLogout {
+            homeserver: self.homeserver.clone(),
+            user_id: meta.user_id.clone(),
+            device_id: meta.device_id.clone(),
+            client_id: client_id
+                .as_ref()
+                .map(|client_id| client_id.as_str().to_owned()),
+        })
+    }
+
     pub(crate) fn soft_logged_out(self) -> Self {
         let authentication = match self.authentication {
             AuthenticationRecord::Matrix(session) => AuthenticationRecord::SoftLoggedOut {
@@ -361,6 +383,27 @@ impl SoftLogout {
             .with_device_id(self.device_id.clone())
             .allow_insecure_loopback(true)
     }
+
+    #[must_use]
+    pub fn oauth_login(
+        &self,
+        redirect_uri: impl Into<String>,
+        client_uri: impl Into<String>,
+        application_type: OAuthApplicationType,
+    ) -> OAuthLogin {
+        let login = OAuthLogin::new(
+            self.homeserver.clone(),
+            redirect_uri,
+            client_uri,
+            application_type,
+        )
+        .with_device_id(self.device_id.clone())
+        .allow_insecure_loopback(true);
+        match &self.client_id {
+            Some(client_id) => login.with_client_id(client_id.clone()),
+            None => login,
+        }
+    }
 }
 
 #[derive(Debug, Error)]
@@ -382,6 +425,9 @@ pub enum AccountError {
     /// what was typed can't name a homeserver, so nothing was sent anywhere
     #[error("that isn't a usable homeserver, {0}")]
     InvalidHomeserver(&'static str),
+    /// `Accounts` already has a live login for them. a second would be another device
+    #[error("{0} is already logged in")]
+    AlreadyLoggedIn(OwnedUserId),
     /// an IndexedDB delete is waiting on the store's other connections. it goes through
     /// once they close, and opening the store again waits behind it
     #[error("the store is still open elsewhere, it will be deleted once that closes")]
@@ -453,8 +499,17 @@ impl Session {
         login: PasswordLogin,
         sessions: Arc<dyn SessionStore>,
     ) -> Result<Self, AccountError> {
-        let homeserver = homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
+        homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
         let store_lock = sessions.store().lock().await?;
+        Self::login_password_locked(login, sessions, store_lock).await
+    }
+
+    pub(crate) async fn login_password_locked(
+        login: PasswordLogin,
+        sessions: Arc<dyn SessionStore>,
+        store_lock: StoreLock,
+    ) -> Result<Self, AccountError> {
+        let homeserver = homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
         let client = matrix_client_builder(sessions.store())
             .server_name_or_homeserver_url(homeserver)
             .build()
@@ -483,12 +538,21 @@ impl Session {
         login: OAuthLogin,
         sessions: Arc<dyn SessionStore>,
     ) -> Result<PendingOAuthLogin, AccountError> {
+        homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
+        let store_lock = sessions.store().lock().await?;
+        Self::begin_oauth_locked(login, sessions, store_lock).await
+    }
+
+    pub(crate) async fn begin_oauth_locked(
+        login: OAuthLogin,
+        sessions: Arc<dyn SessionStore>,
+        store_lock: StoreLock,
+    ) -> Result<PendingOAuthLogin, AccountError> {
         let redirect_uri = Url::parse(login.redirect_uri.trim())
             .map_err(|error| account_error("parsing the OAuth redirect URI", error))?;
         let client_uri = Url::parse(login.client_uri.trim())
             .map_err(|error| account_error("parsing the OAuth client URI", error))?;
         let homeserver = homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
-        let store_lock = sessions.store().lock().await?;
         let client = matrix_client_builder(sessions.store())
             .server_name_or_homeserver_url(homeserver)
             .build()
@@ -718,7 +782,10 @@ fn matrix_client_builder(store: &StoreConfig) -> ClientBuilder {
 }
 
 /// a bare server name goes through untouched, since that's what makes the sdk try `.well-known`
-fn homeserver_input(input: &str, allow_insecure_loopback: bool) -> Result<&str, AccountError> {
+pub(crate) fn homeserver_input(
+    input: &str,
+    allow_insecure_loopback: bool,
+) -> Result<&str, AccountError> {
     let input = input.trim();
     let invalid = |reason| Err(AccountError::InvalidHomeserver(reason));
     if input.is_empty() {

Added file: src/accounts.rs+407 additions@@ -0,0 +1,407 @@
+use std::sync::Arc;
+#[cfg(feature = "sqlite")]
+use std::{collections::BTreeSet, path::PathBuf};
+
+use ruma::TransactionId;
+
+use crate::{
+    AccountError, EncryptedSessionStore, OAuthLogin, PasswordLogin, PendingOAuthLogin, Restore,
+    Session, SessionRecord, SessionStore, SoftLogout, StoreConfig, account::homeserver_input,
+    engine::StoreLock,
+};
+
+/// every account one owner has, a store each under one root and one passphrase. whoever holds
+/// the set can resume any soft-logged-out device in it with just its password, and the device's
+/// store has its e2ee keys, so a set belongs to one person and never to a whole machine
+pub struct Accounts {
+    root: Root,
+    passphrase: String,
+}
+
+enum Root {
+    #[cfg(feature = "sqlite")]
+    Directory(PathBuf),
+    #[cfg(feature = "indexeddb")]
+    Prefix(String),
+}
+
+/// one account's record and store
+#[derive(Clone)]
+pub struct Account {
+    id: String,
+    sessions: Arc<EncryptedSessionStore>,
+}
+
+impl Account {
+    /// stable for the account's life, and safe in a cookie or a url
+    #[must_use]
+    pub fn id(&self) -> &str {
+        &self.id
+    }
+
+    /// for `Termination::retain`. a discarded account drops out of `Accounts::list`
+    #[must_use]
+    pub fn sessions(&self) -> Arc<dyn SessionStore> {
+        self.sessions.clone()
+    }
+
+    pub async fn restore(&self) -> Result<Option<Restore>, AccountError> {
+        Session::restore(self.sessions()).await
+    }
+}
+
+impl std::fmt::Debug for Account {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("Account")
+            .field("id", &self.id)
+            .finish_non_exhaustive()
+    }
+}
+
+enum Found {
+    Nobody,
+    SoftLoggedOut(Account, SoftLogout),
+}
+
+impl Accounts {
+    /// each account is a store directory under `root` with its record beside it
+    #[cfg(feature = "sqlite")]
+    #[must_use]
+    pub fn sqlite(root: impl Into<PathBuf>, passphrase: impl Into<String>) -> Self {
+        Self {
+            root: Root::Directory(root.into()),
+            passphrase: passphrase.into(),
+        }
+    }
+
+    /// each account is a store named `<prefix>::<id>`, listed in `<prefix>::macltok-accounts`
+    #[cfg(feature = "indexeddb")]
+    #[must_use]
+    pub fn indexeddb(prefix: impl Into<String>, passphrase: impl Into<String>) -> Self {
+        Self {
+            root: Root::Prefix(prefix.into()),
+            passphrase: passphrase.into(),
+        }
+    }
+
+    /// `None` for anything `Account::id` couldn't have been
+    #[must_use]
+    pub fn account(&self, id: &str) -> Option<Account> {
+        let valid =
+            !id.is_empty() && id.len() <= 64 && id.bytes().all(|b| b.is_ascii_alphanumeric());
+        valid.then(|| self.open(id.to_owned()))
+    }
+
+    /// every account with a record. a store left without one, by a login that died halfway or a
+    /// discard that couldn't finish, is deleted on the way past
+    pub async fn list(&self) -> Result<Vec<Account>, AccountError> {
+        let mut accounts = Vec::new();
+        for account in self.slots().await? {
+            match account.sessions.load().await {
+                Ok(None) => self.sweep(&account).await,
+                Ok(Some(_)) | Err(_) => accounts.push(account),
+            }
+        }
+        Ok(accounts)
+    }
+
+    /// a soft-logged-out account the login names is resumed as its own device, keeping its keys.
+    /// anyone else gets a new account
+    pub async fn login_password(
+        &self,
+        login: PasswordLogin,
+    ) -> Result<(Account, Session), AccountError> {
+        homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
+        let found = self
+            .find(|record| record_names(record, &login.homeserver, &login.username))
+            .await?;
+        match found {
+            Found::SoftLoggedOut(account, soft) => {
+                let store_lock = account.sessions.store().lock().await?;
+                let login = PasswordLogin {
+                    device_display_name: login.device_display_name,
+                    ..soft.password_login(login.password)
+                };
+                let session =
+                    Session::login_password_locked(login, account.sessions(), store_lock).await?;
+                Ok((account, session))
+            }
+            Found::Nobody => {
+                let (account, store_lock) = self.fresh().await?;
+                let login = PasswordLogin {
+                    device_id: None,
+                    ..login
+                };
+                match Session::login_password_locked(login, account.sessions(), store_lock).await {
+                    Ok(session) => Ok((account, session)),
+                    Err(error) => Err(self.abandon(&account, error).await),
+                }
+            }
+        }
+    }
+
+    /// resumes the soft-logged-out account whose device `login` names, as
+    /// `SoftLogout::oauth_login` sets it. without one it's a new account, since which account an
+    /// OAuth login is for isn't known until it finishes
+    pub async fn begin_oauth(
+        &self,
+        login: OAuthLogin,
+    ) -> Result<(Account, PendingOAuthLogin), AccountError> {
+        homeserver_input(&login.homeserver, login.allow_insecure_loopback)?;
+        let device_id = login.device_id.clone();
+        let found = self
+            .find(|record| {
+                record
+                    .soft_logout()
+                    .is_some_and(|soft| device_id.as_ref() == Some(&soft.device_id))
+            })
+            .await?;
+        match found {
+            Found::SoftLoggedOut(account, soft) => {
+                let store_lock = account.sessions.store().lock().await?;
+                let login = OAuthLogin {
+                    homeserver: soft.homeserver,
+                    client_id: login.client_id.or(soft.client_id),
+                    allow_insecure_loopback: true,
+                    ..login
+                };
+                let pending =
+                    Session::begin_oauth_locked(login, account.sessions(), store_lock).await?;
+                Ok((account, pending))
+            }
+            Found::Nobody => {
+                let (account, store_lock) = self.fresh().await?;
+                let login = OAuthLogin {
+                    device_id: None,
+                    ..login
+                };
+                match Session::begin_oauth_locked(login, account.sessions(), store_lock).await {
+                    Ok(pending) => Ok((account, pending)),
+                    Err(error) => Err(self.abandon(&account, error).await),
+                }
+            }
+        }
+    }
+
+    /// a live login for the same person is refused rather than given a second device
+    async fn find(&self, resumes: impl Fn(&SessionRecord) -> bool) -> Result<Found, AccountError> {
+        for account in self.slots().await? {
+            let Ok(Some(record)) = account.sessions.load().await else {
+                continue;
+            };
+            if !resumes(&record) {
+                continue;
+            }
+            return match record.soft_logout() {
+                Some(soft) => Ok(Found::SoftLoggedOut(account, soft)),
+                None => Err(AccountError::AlreadyLoggedIn(record.user_id().clone())),
+            };
+        }
+        Ok(Found::Nobody)
+    }
+
+    /// locked before anything else can see it, so `list` never sweeps a login still under way
+    async fn fresh(&self) -> Result<(Account, StoreLock), AccountError> {
+        let account = self.open(TransactionId::new().to_string());
+        let store_lock = account.sessions.store().lock().await?;
+        #[cfg(feature = "indexeddb")]
+        {
+            let Root::Prefix(prefix) = &self.root;
+            index::add(prefix, &account.id).await?;
+        }
+        Ok((account, store_lock))
+    }
+
+    /// a failed first login leaves nothing behind. one whose record didn't save has a live device
+    /// on the server, so that stays for `UnsavedSession::save`
+    async fn abandon(&self, account: &Account, error: AccountError) -> AccountError {
+        if !matches!(error, AccountError::Unsaved { .. }) {
+            self.sweep(account).await;
+        }
+        error
+    }
+
+    /// best effort, since whatever it leaves is found and swept again by the next `list`
+    async fn sweep(&self, account: &Account) {
+        let Ok(_store_lock) = account.sessions.store().lock().await else {
+            return;
+        };
+        if !matches!(account.sessions.load().await, Ok(None)) {
+            return;
+        }
+        if account.sessions.discard().await.is_err() {
+            return;
+        }
+        #[cfg(feature = "indexeddb")]
+        {
+            let Root::Prefix(prefix) = &self.root;
+            let _ = index::remove(prefix, &account.id).await;
+        }
+    }
+
+    fn open(&self, id: String) -> Account {
+        let sessions = match &self.root {
+            #[cfg(feature = "sqlite")]
+            Root::Directory(root) => EncryptedSessionStore::file(
+                root.join(format!("{id}.session")),
+                StoreConfig::sqlite(root.join(&id), self.passphrase.clone()),
+            ),
+            #[cfg(feature = "indexeddb")]
+            Root::Prefix(prefix) => EncryptedSessionStore::indexeddb(StoreConfig::indexeddb(
+                format!("{prefix}::{id}"),
+                self.passphrase.clone(),
+            )),
+        };
+        Account {
+            id,
+            sessions: Arc::new(sessions),
+        }
+    }
+
+    async fn slots(&self) -> Result<Vec<Account>, AccountError> {
+        let ids = match &self.root {
+            #[cfg(feature = "sqlite")]
+            Root::Directory(root) => directory_slots(root)?,
+            #[cfg(feature = "indexeddb")]
+            Root::Prefix(prefix) => index::list(prefix).await?,
+        };
+        Ok(ids.iter().filter_map(|id| self.account(id)).collect())
+    }
+}
+
+/// a localpart or a full user id names the same account, but only on the same server. the server
+/// is compared by name as well as by url, so a delegated `example.org` still finds the account
+/// discovery took to `matrix.example.org`
+fn record_names(record: &SessionRecord, homeserver: &str, username: &str) -> bool {
+    let user_id = record.user_id();
+    let username = username.trim();
+    let user = if username.starts_with('@') {
+        username.eq_ignore_ascii_case(user_id.as_str())
+    } else {
+        username.eq_ignore_ascii_case(user_id.localpart())
+    };
+    let typed = authority(homeserver);
+    user && (typed.eq_ignore_ascii_case(user_id.server_name().as_str())
+        || typed.eq_ignore_ascii_case(authority(record.homeserver())))
+}
+
+fn authority(homeserver: &str) -> &str {
+    let homeserver = homeserver.trim();
+    let rest = homeserver
+        .split_once("://")
+        .map_or(homeserver, |(_, rest)| rest);
+    rest.split('/').next().unwrap_or(rest)
+}
+
+#[cfg(feature = "sqlite")]
+fn directory_slots(root: &std::path::Path) -> Result<BTreeSet<String>, AccountError> {
+    use std::io::ErrorKind;
+
+    let entries = match std::fs::read_dir(root) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == ErrorKind::NotFound => return Ok(BTreeSet::new()),
+        Err(error) => return Err(crate::account::account_error("listing the accounts", error)),
+    };
+    let mut ids = BTreeSet::new();
+    for entry in entries {
+        let entry =
+            entry.map_err(|error| crate::account::account_error("listing the accounts", error))?;
+        let name = entry.file_name();
+        let Some(name) = name.to_str() else {
+            continue;
+        };
+        if entry.path().is_dir() {
+            ids.insert(name.to_owned());
+        } else if let Some(id) = name.strip_suffix(".session") {
+            ids.insert(id.to_owned());
+        }
+    }
+    Ok(ids)
+}
+
+/// a key per account, so two tabs adding at once can't lose one to the other
+#[cfg(feature = "indexeddb")]
+mod index {
+    use std::collections::BTreeSet;
+
+    use indexed_db_futures::{
+        Build,
+        database::Database,
+        error::{Error, OpenDbError},
+        prelude::*,
+        transaction::{Transaction, TransactionMode},
+    };
+
+    use crate::{AccountError, account::account_error};
+
+    const ACCOUNTS: &str = "accounts";
+
+    fn name(prefix: &str) -> String {
+        format!("{prefix}::macltok-accounts")
+    }
+
+    async fn open(prefix: &str) -> Result<Database, OpenDbError> {
+        Database::open(&name(prefix))
+            .with_version(1u32)
+            .with_on_upgrade_needed(|_, transaction: &Transaction<'_>| -> Result<(), Error> {
+                transaction.db().create_object_store(ACCOUNTS).build()?;
+                Ok(())
+            })
+            .build()?
+            .await
+    }
+
+    pub(super) async fn list(prefix: &str) -> Result<BTreeSet<String>, AccountError> {
+        let failed = |error| account_error("listing the accounts", error);
+        let database = open(prefix).await.map_err(failed)?;
+        let ids = keys(&database).await;
+        database.close();
+        ids.map_err(|error| account_error("listing the accounts", error))
+    }
+
+    pub(super) async fn add(prefix: &str, id: &str) -> Result<(), AccountError> {
+        let failed = |error| account_error("adding the account", error);
+        let database = open(prefix).await.map_err(failed)?;
+        let added = write(&database, |store| {
+            store.put(true).with_key(id).build()?;
+            Ok(())
+        })
+        .await;
+        database.close();
+        added.map_err(|error| account_error("adding the account", error))
+    }
+
+    pub(super) async fn remove(prefix: &str, id: &str) -> Result<(), AccountError> {
+        let failed = |error| account_error("removing the account", error);
+        let database = open(prefix).await.map_err(failed)?;
+        let removed = write(&database, |store| {
+            store.delete(id).build()?;
+            Ok(())
+        })
+        .await;
+        database.close();
+        removed.map_err(|error| account_error("removing the account", error))
+    }
+
+    async fn keys(database: &Database) -> Result<BTreeSet<String>, Error> {
+        let transaction = database
+            .transaction(ACCOUNTS)
+            .with_mode(TransactionMode::Readonly)
+            .build()?;
+        let store = transaction.object_store(ACCOUNTS)?;
+        store.get_all_keys::<String>().await?.collect()
+    }
+
+    async fn write(
+        database: &Database,
+        change: impl FnOnce(&indexed_db_futures::object_store::ObjectStore<'_>) -> Result<(), Error>,
+    ) -> Result<(), Error> {
+        let transaction = database
+            .transaction(ACCOUNTS)
+            .with_mode(TransactionMode::Readwrite)
+            .build()?;
+        change(&transaction.object_store(ACCOUNTS)?)?;
+        transaction.commit().await
+    }
+}

Modified file: src/lib.rs+4 additions@@ -21,6 +21,8 @@ compile_error!("indexeddb only exists in a browser, use sqlite");
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 mod account;
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
+mod accounts;
+#[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 mod session_store;
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 mod store_lock;
@@ -31,6 +33,8 @@ pub use account::{
     Session, SessionRecord, SoftLogout, StoreConfig, UnsavedSession,
 };
 #[cfg(any(feature = "sqlite", feature = "indexeddb"))]
+pub use accounts::{Account, Accounts};
+#[cfg(any(feature = "sqlite", feature = "indexeddb"))]
 pub use session_store::{EncryptedSessionStore, SessionStore};
 
 pub use engine::{Engine, EngineConfig, EngineError};

Modified file: tests/account.rs+84 additions−2 deletions@@ -4,8 +4,8 @@ mod support;
 use std::{path::PathBuf, sync::Arc, time::SystemTime};
 
 use macltok::{
-    AccountError, EncryptedSessionStore, EngineConfig, Event, PasswordLogin, Restore, Session,
-    SessionRecord, SessionStore, StoreConfig,
+    AccountError, Accounts, EncryptedSessionStore, EngineConfig, Event, PasswordLogin, Restore,
+    Session, SessionRecord, SessionStore, StoreConfig,
 };
 use matrix_sdk::{ruma::api::client::sync::sync_events::v5, test_utils::mocks::MatrixMockServer};
 
@@ -302,6 +302,88 @@ async fn a_refresh_is_saved_before_anyone_hears_of_it() {
 }
 
 #[tokio::test]
+async fn logging_in_again_after_a_soft_logout_keeps_the_device_and_its_store() {
+    let server = MatrixMockServer::new().await;
+    server.mock_versions().ok().mount().await;
+    server.mock_login().ok().mount().await;
+    let root = temporary_path();
+    let accounts = Accounts::sqlite(&root, "test store passphrase");
+    let login = |username: &str| {
+        PasswordLogin::new(server.uri(), username, "wordpass").allow_insecure_loopback(true)
+    };
+    let device_ids = || async {
+        let requests = server.server().received_requests().await.unwrap();
+        requests
+            .iter()
+            .filter(|request| request.url.path().ends_with("/login"))
+            .map(|request| request.body_json::<serde_json::Value>().unwrap()["device_id"].clone())
+            .collect::<Vec<_>>()
+    };
+
+    let (first, session) = accounts
+        .login_password(login("cheeky_monkey"))
+        .await
+        .unwrap();
+    drop(session);
+    assert!(matches!(
+        accounts.login_password(login("cheeky_monkey")).await,
+        Err(AccountError::AlreadyLoggedIn(_))
+    ));
+
+    first.sessions().soft_log_out().await.unwrap();
+    let (resumed, session) = accounts
+        .login_password(login(" Cheeky_Monkey "))
+        .await
+        .unwrap();
+    drop(session);
+    assert_eq!(resumed.id(), first.id());
+    assert_eq!(device_ids().await.last().unwrap(), "GHTYAJCE");
+
+    resumed.sessions().soft_log_out().await.unwrap();
+    let (other, session) = accounts
+        .login_password(login("someone_else"))
+        .await
+        .unwrap();
+    drop(session);
+    assert_ne!(other.id(), first.id());
+    assert!(device_ids().await.last().unwrap().is_null());
+    assert_eq!(accounts.list().await.unwrap().len(), 2);
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+#[tokio::test]
+async fn a_refused_login_leaves_no_account_and_says_why() {
+    use wiremock::ResponseTemplate;
+
+    let server = MatrixMockServer::new().await;
+    server.mock_versions().ok().mount().await;
+    server
+        .mock_login()
+        .respond_with(ResponseTemplate::new(403).set_body_json(serde_json::json!({
+            "errcode": "M_FORBIDDEN",
+            "error": "Invalid username or password",
+        })))
+        .mount()
+        .await;
+    let root = temporary_path();
+    let accounts = Accounts::sqlite(&root, "test store passphrase");
+    let Err(refused) = accounts
+        .login_password(
+            PasswordLogin::new(server.uri(), "example", "wrong").allow_insecure_loopback(true),
+        )
+        .await
+    else {
+        panic!("a refused login went through");
+    };
+    let server_error = refused.server().unwrap();
+    assert_eq!(server_error.errcode, "M_FORBIDDEN");
+    assert_eq!(server_error.message, "Invalid username or password");
+    assert!(accounts.list().await.unwrap().is_empty());
+    assert_eq!(std::fs::read_dir(&root).unwrap().count(), 0);
+    std::fs::remove_dir_all(root).unwrap();
+}
+
+#[tokio::test]
 async fn a_homeserver_that_cant_be_one_is_refused_before_anything_is_sent() {
     let root = temporary_path();
     let sessions: Arc<dyn SessionStore> = Arc::new(EncryptedSessionStore::file(

macltok

Commit cb0668d30c14

Commit `cb0668d30c14`