cinny/src/app/state/plaintextCaches.ts

import { clearTranslationCache } from './translation';
import { clearScheduledMessages } from './scheduledMessages';
import { clearRecentSearches } from './recentSearches';
import { clearRecentForwardTargets } from './recentForwardTargets';
import { clearRecentGifs } from './recentGifs';
import { clearRecentStickers } from './recentStickers';
import { clearNavToActivePathStore } from './navToActivePath';
import { DRAFT_MSG_KEY_PREFIX } from '../utils/draft';
import { clearCallSession } from '../utils/callRejoin';
import { clearOutbox } from '../utils/outbox';
import { NUDGE_KEY_PREFIX } from '../utils/securityNudge';

/**
 * [Gitea #41] Wipe every persisted composer draft (`draft-msg-<roomId>`). Drafts
 * hold decrypted, unsent message text with no user scoping, so leaving them in
 * place across logout lets the next account on this device see (and send) the
 * previous user's draft the moment they open the same room.
 */
const clearMsgDrafts = (): void => {
  let keys: string[];
  try {
    keys = Object.keys(localStorage);
  } catch {
    return;
  }
  keys.forEach((key) => {
    if (key.startsWith(DRAFT_MSG_KEY_PREFIX)) {
      try {
        localStorage.removeItem(key);
      } catch {
        // Best-effort — a single unreadable/blocked key must not abort the sweep.
      }
    }
  });
};

/**
 * Single auditable place that wipes the `localStorage` caches holding decrypted
 * message content, sent media, or a user's messaging/nav activity. Called on
 * logout so this residue can't survive on a shared device.
 *
 * Swept here:
 * - `cinny_translation_cache_v1` — decrypted translated message text
 * - `cinny_scheduled_messages_v1` — decrypted `IContent.body` of pending sends
 * - `cinny_recent_searches_v1` — search query text (PII)
 * - `cinny_recent_forward_targets_v1` — recent forward contact/room graph (PII)
 * - `cinny_recent_gifs_v1` / `cinny_recent_stickers_v1` — media the user sent
 * - `navToActivePath<userId>` — per-space last-visited room paths (needs userId)
 * - `lotus_outbox_v1` — decrypted content of messages not yet sent ([Gitea #112])
 * - `lotus-per-user-volume`, `settings-sync-meta:<userId>` — whom you adjusted in
 *   calls, and a key naming the account ([Gitea #347])
 * - `draft-msg-*` — unsent composer drafts (decrypted message text, unscoped by
 *   user — see [Gitea #41]; previously deliberately preserved across logout
 *   (N98), which let the next account on this device see/send a prior user's
 *   draft, so this is no longer a "by design" exemption)
 *
 * NOT swept here (by design):
 * - session credential keys → `removeFallbackSession()`
 * - the SDK sync/crypto store + all `io.lotus.*` account data (reminders,
 *   bookmarks, user notes, status presets — themselves plaintext) → wiped by
 *   `mx.clearStores()` on both logout paths
 * - the opt-in encrypted-search index (IndexedDB) → `deleteSearchCacheDatabase()`
 * - (the presence status message + expiry, `lotus-status-msg-*` /
 *   `lotus-status-expiry-*`, used to be preserved; since [Gitea #204] they are
 *   swept with the rest — the server-side presence status survives, so a
 *   re-login loses nothing)
 * - low-sensitivity UI/metadata residue (`io.lotus.mute_timers`, collapsed
 *   nav/space categories, `cinny_oidc_dynamic_clients`) is treated as
 *   preferences, not swept here
 */
/**
 * [Gitea #204] The local mirror of the user's status message (+ its expiry) is
 * PII in plaintext; the authoritative copy lives in server presence.
 */
const clearStatusMessage = (): void => {
  let keys: string[];
  try {
    keys = Object.keys(localStorage);
  } catch {
    return;
  }
  keys.forEach((key) => {
    if (
      key.startsWith('lotus-status-msg-') ||
      key.startsWith('lotus-status-expiry-') ||
      key.startsWith(NUDGE_KEY_PREFIX)
    ) {
      try {
        localStorage.removeItem(key);
      } catch {
        // best-effort
      }
    }
  });
};

/**
 * [Gitea #347] Per-person residue that isn't message text but still says whom
 * the previous user dealt with: Element Call's per-user volume memory (same
 * origin on the web — element-call `lotusVolumeMemory.ts`) and the settings-sync
 * stamp, whose key names the account.
 */
export const CALL_VOLUME_KEY = 'lotus-per-user-volume';
const clearCallVolumesAndSyncMeta = (userId?: string): void => {
  const keys = [CALL_VOLUME_KEY, ...(userId ? [`settings-sync-meta:${userId}`] : [])];
  keys.forEach((key) => {
    try {
      localStorage.removeItem(key);
    } catch {
      // best-effort
    }
  });
};

// [Gitea #319] Set once a logout has wiped the caches. Logout then reloads the
// page, and the reload's `pagehide` made RoomInput flush the open composer's
// draft straight back to localStorage; draft writes check this and stop.
// Module state, so it resets with the new page.
let wiped = false;
export const plaintextCachesWiped = (): boolean => wiped;

/**
 * [Gitea #296] Device-wide flags/keys that carry the previous account's choice
 * or id: the encrypted-search opt-in (the next account would otherwise start
 * indexing decrypted text without opting in) and the SDK's per-user filter key.
 */
const clearAccountScopedFlags = (userId?: string): void => {
  const keys = [
    'searchCacheEnabled',
    ...(userId ? [`mxjssdk_memory_filter_FILTER_SYNC_${userId}`] : []),
  ];
  keys.forEach((key) => {
    try {
      localStorage.removeItem(key);
    } catch {
      // best-effort
    }
  });
};

export const clearPlaintextCaches = (userId?: string): void => {
  wiped = true;
  clearTranslationCache();
  clearScheduledMessages();
  clearRecentSearches();
  clearRecentForwardTargets();
  clearRecentGifs();
  clearRecentStickers();
  clearMsgDrafts();
  clearOutbox();
  clearCallSession();
  clearStatusMessage();
  clearCallVolumesAndSyncMeta(userId);
  clearAccountScopedFlags(userId);
  if (userId) clearNavToActivePathStore(userId);
};