LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Logout leaves the call-volume list behind: lotus-per-user-volume (the people you adjusted, with their volumes) and a settings-sync key named after the previous user #347

New Issue
Closed
opened 2026-10-11 00:51:40 -04:00 by jared · 0 comments
jared commented 2026-10-11 00:51:40 -04:00
Owner
Copy Link
Copy Source

clearPlaintextCaches (src/app/state/plaintextCaches.ts) sweeps per-person residue on logout, e.g. "the recent forward contact/room graph (PII)" (#204). It doesn't sweep lotus-per-user-volume, Element Call's per-person volume memory (element-call src/lotus/lotusVolumeMemory.ts, keyed by Matrix user ID). On the web the call page is same-origin (/public/element-call/), so this key sits in the app's own localStorage.

Measured (local Synapse; joined and left a call, volume map {"@aud_bob:localhost":0.3,"@aud_carol:localhost":1.8}, then Log out via Settings). Left in localStorage afterwards:

lotus-per-user-volume                      {"@aud_bob:localhost":0.3,"@aud_carol:localhost":1.8}
settings-sync-meta:@aud_main:localhost     {"lastSyncedAt":1791682372315}
mxjssdk_memory_filter_FILTER_SYNC_@aud_main:localhost   (upstream SDK residue)

Correctly cleared ✔: the session keys, lotus-security-nudge-*, navToActivePath@…, the drafts, outbox and status keys.

The volume map tells the next person on a shared device whom the previous user called, and whom they turned down or up. That's the same class of data as the forward-target graph that is already swept. settings-sync-meta:<userId> names the previous account.

Fix:

  • Add lotus-per-user-volume and settings-sync-meta:${userId} to clearPlaintextCaches.
  • For the desktop's opt-in loopback call origin (#43), Element Call's storage lives on another origin. Clear it from the Tauri side on logout (clear_all_browsing_data for that origin), or have the host send an io.lotus.clear_storage action to the widget before it's torn down.
  • Optionally the SDK's mxjssdk_memory_filter_* as well (harmless, but it carries the user ID).

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

`clearPlaintextCaches` (src/app/state/plaintextCaches.ts) sweeps per-person residue on logout, e.g. "the recent forward contact/room graph (PII)" (#204). It doesn't sweep **`lotus-per-user-volume`**, Element Call's per-person volume memory (element-call `src/lotus/lotusVolumeMemory.ts`, keyed by Matrix user ID). On the web the call page is same-origin (`/public/element-call/`), so this key sits in the app's own localStorage. **Measured** (local Synapse; joined and left a call, volume map `{"@aud_bob:localhost":0.3,"@aud_carol:localhost":1.8}`, then **Log out** via Settings). Left in localStorage afterwards: ``` lotus-per-user-volume {"@aud_bob:localhost":0.3,"@aud_carol:localhost":1.8} settings-sync-meta:@aud_main:localhost {"lastSyncedAt":1791682372315} mxjssdk_memory_filter_FILTER_SYNC_@aud_main:localhost (upstream SDK residue) ``` Correctly cleared ✔: the session keys, `lotus-security-nudge-*`, `navToActivePath@…`, the drafts, outbox and status keys. The volume map tells the next person on a shared device whom the previous user called, and whom they turned down or up. That's the same class of data as the forward-target graph that is already swept. `settings-sync-meta:<userId>` names the previous account. **Fix:** - Add `lotus-per-user-volume` and `settings-sync-meta:${userId}` to `clearPlaintextCaches`. - For the desktop's opt-in loopback call origin (#43), Element Call's storage lives on another origin. Clear it from the Tauri side on logout (`clear_all_browsing_data` for that origin), or have the host send an `io.lotus.clear_storage` action to the widget before it's torn down. - Optionally the SDK's `mxjssdk_memory_filter_*` as well (harmless, but it carries the user ID). --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the priority: lowsecurityarea: auth-session labels 2026-10-11 00:51:40 -04:00
jared closed this issue 2026-10-12 16:07:43 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: auth-session priority: low security
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#347