Data not scoped by account — logout leaks state #18

New issue

Closed

opened 2026-06-18 00:02:10 +00:00 by starsetbyte · 1 comment

starsetbyte commented

2026-06-18 00:02:10 +00:00

Owner

Problem

Logout clears auth but not Room/DataStore. Second account sees first account's drafts, timeline, feeds.

Proposed fix

Clear account-bound data on logout. Better: accountDid on entities or separate DB per DID.

Source: Codex code review — technical #3

## Problem Logout clears auth but not Room/DataStore. Second account sees first account's drafts, timeline, feeds. ## Proposed fix Clear account-bound data on logout. Better: accountDid on entities or separate DB per DID. Source: Codex code review — technical #3

starsetbyte added the

bug

auth

safety

labels

2026-06-18 00:02:10 +00:00

starsetbyte referenced this issue from a commit

2026-06-21 12:32:05 +00:00

fix(auth): wipe account-bound data on logout — closes #18

starsetbyte referenced this issue from a pull request that will close it,

2026-06-21 12:32:23 +00:00

fix(auth): wipe account-bound data on logout (closes #18) #30

starsetbyte commented

2026-06-21 12:32:36 +00:00

Author

Owner

Fix up in PR #30 (fix/logout-clears-account-data).

Implemented the issue's proposed clear-on-logout fix: a new AccountDataCleaner wipes every account-bound store on logout — Room (clearAllTables: posts/cursors/drafts/notifications), draft image files on disk, the cached feed preferences (including the @Singleton's in-memory snapshot), and recent searches. Theme / dynamic-color / migration-dismissed are preserved (device-level, not account-level).

Two things deliberately left as follow-ups, noted in the PR:

Per-DID scoping (the "better" option) for keeping data across fast account switches.
Session-expiry vector: TokenAuthenticator's forced logout calls SessionManager.clearSession() directly rather than logout(), so expiry-then-different-account isn't covered. Cleanest to fix alongside per-DID scoping by clearing at the login boundary — that also covers OAuth login, which bypasses AuthRepository (saves via OAuthLoginViewModel).

Will auto-close on merge.

Fix up in **PR #30** (`fix/logout-clears-account-data`). Implemented the issue's proposed **clear-on-logout** fix: a new `AccountDataCleaner` wipes every account-bound store on logout — Room (`clearAllTables`: posts/cursors/drafts/notifications), draft image files on disk, the cached feed preferences (including the `@Singleton`'s in-memory snapshot), and recent searches. Theme / dynamic-color / migration-dismissed are preserved (device-level, not account-level). Two things deliberately left as follow-ups, noted in the PR: - **Per-DID scoping** (the "better" option) for keeping data across fast account switches. - **Session-expiry vector:** `TokenAuthenticator`'s forced logout calls `SessionManager.clearSession()` directly rather than `logout()`, so expiry-then-different-account isn't covered. Cleanest to fix alongside per-DID scoping by clearing at the login boundary — that also covers OAuth login, which bypasses `AuthRepository` (saves via `OAuthLoginViewModel`). Will auto-close on merge.

starsetbyte referenced this issue

2026-06-21 12:34:59 +00:00

Multi-account support: per-DID data scoping + clear-on-account-change #31

starsetbyte referenced this issue from a commit

2026-06-21 12:54:56 +00:00

fix(feeds): align clearLocalData with snapshot-based FeedPreferencesRepository

starsetbyte closed this issue

2026-06-21 14:18:31 +00:00

starsetbyte referenced this issue from a commit

2026-06-21 14:18:32 +00:00

Merge pull request 'fix(auth): wipe account-bound data on logout (closes #18)' (#30) from fix/logout-clears-account-data into main