3 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5	e078a2cc10	privacy: wipe the local status-message mirror on logout (#204) ... Of the two plaintext-localStorage items in #204, composer drafts were already swept on logout (#41); the presence status message + expiry were deliberately kept. They are PII with an authoritative copy in server presence, so sweep them too. The test's localStorage mock now enumerates keys like the real Storage object, so the prefix sweeps (drafts, status) are actually exercised — the old 'draft preserved' assertion only passed because Object.keys() saw nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-19 13:38:47 -04:00
jaredandClaude Opus 5	6e4c4bc795	fix(security): composer drafts no longer survive logout or cross accounts ... draft-msg-<roomId> was unscoped and deliberately skipped on logout, then hydrated into whoever logged in next. Wipe drafts in clearPlaintextCaches, and only hydrate a draft whose stored userId matches the current user. Drafts written before this change carry no userId and are dropped on first load (a one-time loss of unsent drafts, accepted for the leak fix). Fixes #41 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PPmy3tPq869XDW4njjVaKA	2026-09-12 14:48:34 -04:00
jaredandClaude Opus 4.8	726cefb5ab	fix(privacy): wipe plaintext/PII localStorage caches on logout (SEC-1/2) ... Several localStorage caches held decrypted message content or user PII and survived a normal logout, leaving residue on a shared device (the search index was already wiped; these were not): - cinny_scheduled_messages_v1 - decrypted IContent.body of pending sends - cinny_recent_searches_v1 - search query text - cinny_recent_forward_targets_v1 - recent forward contact/room graph - cinny_recent_gifs_v1 / cinny_recent_stickers_v1 - media the user sent - navToActivePath<userId> - per-space last-visited room paths - (plus the translation cache added earlier) Add a clear function per module and a single auditable clearPlaintextCaches() aggregator, called from both logout paths (logoutClient + the server-forced SessionLoggedOut handler) alongside the existing session/search-index wipes. Unit-tested. Deliberately NOT cleared (documented in the aggregator): unsent composer drafts and the presence status message (preserved by product decision N98); SDK sync/crypto store + io.lotus.* account data (reminders/bookmarks/notes), already wiped by mx.clearStores(); low-sensitivity UI/metadata residue. The forward-targets/gifs/stickers/nav-path additions and the accurate "not covered" documentation address findings from two review passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-18 16:56:08 -04:00