fix: preserve Cloud sign-in across native app restarts

Author: adibhanna

src/bridge/mobile-cloud-auth.test.ts

@@ -0,0 +1,86 @@
+import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
+import { it } from 'node:test'
+import { registerPlugin } from '@capacitor/core'
+import { loadMobileModule } from '../../tooling/load-mobile-module.ts'
+
+const account = {
+  base_url: 'https://zennotes.org', connected_at: '2026-09-14T12:00:00Z',
+  user: { name: 'Test', email: 'test@example.test' },
+  device: { id: 'test-device', name: 'Test phone', platform: 'android' }
+}
+const credential = JSON.stringify({ base_url: account.base_url, token: 'test-only', account })
+
+async function coldLaunch(saved: Map<string, string>) {
+  // Exercise the real Capacitor lazy proxy: concurrent first calls can
+  // instantiate separate implementations, each with its own key prefix.
+  const secureStorage = registerPlugin(`TestCloudStorage${randomUUID()}`, {
+    web: async () => {
+      await Promise.resolve()
+      return new class {
+        prefix = 'capacitor-storage_'
+        async setKeyPrefix(prefix: string) { this.prefix = prefix }
+        async setSynchronize(_value: boolean) {}
+        async setDefaultKeychainAccess(_value: unknown) {}
+        async getItem(key: string) { return saved.get(this.prefix + key) ?? null }
+        async setItem(key: string, value: string) { saved.set(this.prefix + key, value) }
+        async removeItem(key: string) { saved.delete(this.prefix + key) }
+      }()
+    }
+  })
+  const api = await loadMobileModule('./src/bridge/mobile-cloud-auth.ts', {
+    '@capacitor/core': { Capacitor: { isNativePlatform: () => true }, CapacitorHttp: {} },
+    '@capacitor/app': { App: { addListener: async () => ({}), getLaunchUrl: async () => null } },
+    '@aparajita/capacitor-secure-storage': {
+      SecureStorage: secureStorage,
+      KeychainAccess: { whenUnlockedThisDeviceOnly: 'device-only' }
+    },
+    './cloud-sync-client': { createCloudSyncClient: () => assert.fail('status must only read storage') }
+  })
+  await api.configureMobileCloudAuth('test-version')
+  return api
+}
+
+for (const prefix of ['zennotes.cloud.', 'capacitor-storage_']) {
+  it(`loads a saved account from ${prefix} on every cold launch`, async () => {
+    const saved = new Map([[prefix + 'credential', credential]])
+    for (let launch = 0; launch < 2; launch++) {
+      const api = await coldLaunch(saved)
+      const statuses = await Promise.all([api.getMobileCloudAccountStatus(), api.getMobileCloudAccountStatus()])
+      assert.deepEqual(statuses, [{ state: 'connected', account }, { state: 'connected', account }])
+      assert.deepEqual([...saved.keys()], ['zennotes.cloud.credential'])
+    }
+  })
+}
+
+it('preserves the canonical account and prevents a legacy credential from returning after logout', async () => {
+  const saved = new Map([
+    ['zennotes.cloud.credential', credential],
+    ['capacitor-storage_credential', JSON.stringify({ base_url: account.base_url, token: 'old-test-token', account })]
+  ])
+  const api = await coldLaunch(saved)
+  assert.equal((await api.authenticatedCredential()).token, 'test-only')
+  await api.logoutMobileCloudAccount()
+  assert.equal(saved.size, 0)
+  assert.deepEqual(await (await coldLaunch(saved)).getMobileCloudAccountStatus(), { state: 'disconnected', account: null })
+})
+
+it('rejects invalid recovered credentials through the shared auth validator', async () => {
+  const invalid = JSON.stringify({ base_url: 'https://wrong.example.test', token: 'test-only', account })
+  const saved = new Map([['capacitor-storage_credential', invalid]])
+  const api = await coldLaunch(saved)
+  assert.deepEqual(await api.getMobileCloudAccountStatus(), { state: 'disconnected', account: null })
+  assert.equal(saved.size, 0)
+})
+
+it('recovers pending sign-in state across cold launches', async () => {
+  const pending = JSON.stringify({
+    base_url: account.base_url, state: 'test-state', code_verifier: 'a'.repeat(43), expires_at: '2099-01-01T00:00:00Z'
+  })
+  const saved = new Map([['capacitor-storage_pending-auth', pending]])
+  for (let launch = 0; launch < 2; launch++) {
+    const api = await coldLaunch(saved)
+    assert.deepEqual(await api.getMobileCloudAccountStatus(), { state: 'connecting', account: null })
+    assert.deepEqual([...saved.entries()], [['zennotes.cloud.pending-auth', pending]])
+  }
+})

src/bridge/mobile-cloud-auth.ts

@@ -34,33 +34,76 @@ const accountListeners = new Set<(status: CloudAccountStatus) => void>()
 let authFlow: CloudAuthFlow | null = null
 let callbackQueue = Promise.resolve()
 
-const secureStorageReady = Capacitor.isNativePlatform()
-  ? Promise.all([
-      SecureStorage.setKeyPrefix('zennotes.cloud.'),
-      SecureStorage.setSynchronize(false),
-      SecureStorage.setDefaultKeychainAccess(KeychainAccess.whenUnlockedThisDeviceOnly)
-    ]).then(() => undefined)
-  : Promise.resolve()
+// Lazy and retryable so a transient native storage failure does not poison
+// every later account read for the session.
+let secureStorageSetup: Promise<void> | null = null
+function secureStorageReady(): Promise<void> {
+  if (!Capacitor.isNativePlatform()) return Promise.resolve()
+  if (!secureStorageSetup) {
+    secureStorageSetup = configureSecureStorage()
+    secureStorageSetup.catch(() => {
+      secureStorageSetup = null
+    })
+  }
+  return secureStorageSetup
+}
+
+async function configureSecureStorage(): Promise<void> {
+  // The Capacitor proxy loads its implementation lazily. Parallel first
+  // calls can initialize separate instances and lose the configured prefix.
+  await SecureStorage.setKeyPrefix('zennotes.cloud.')
+  await SecureStorage.setSynchronize(false)
+  await SecureStorage.setDefaultKeychainAccess(KeychainAccess.whenUnlockedThisDeviceOnly)
+  await migrateAuthStoragePrefix()
+}
+
+async function migrateAuthStoragePrefix(): Promise<void> {
+  const keys = [CREDENTIAL_KEY, PENDING_AUTH_KEY]
+  const canonical = new Map<string, string | null>()
+  for (const key of keys) canonical.set(key, await SecureStorage.getItem(key))
+
+  // Affected builds could persist auth under the plugin's default prefix.
+  // All storage callers await setup, so none can see this temporary prefix.
+  // CloudAuthFlow still validates every recovered record before using it.
+  try {
+    await SecureStorage.setKeyPrefix('capacitor-storage_')
+    const legacy = new Map<string, string>()
+    for (const key of keys) {
+      const value = await SecureStorage.getItem(key)
+      if (value !== null) legacy.set(key, value)
+    }
+    await SecureStorage.setKeyPrefix('zennotes.cloud.')
+    for (const [key, value] of legacy) {
+      if (canonical.get(key) === null) await SecureStorage.setItem(key, value)
+    }
+    // Remove superseded records as well, so logout cannot resurrect an older
+    // credential on the next launch. Copying must finish before removal.
+    await SecureStorage.setKeyPrefix('capacitor-storage_')
+    for (const key of legacy.keys()) await SecureStorage.removeItem(key)
+  } finally {
+    await SecureStorage.setKeyPrefix('zennotes.cloud.')
+  }
+}
 
 const storage: CloudAuthStorage = {
   async loadPending(): Promise<unknown> {
     if (!Capacitor.isNativePlatform()) return null
-    await secureStorageReady
+    await secureStorageReady()
     return parseStoredJson(await SecureStorage.getItem(PENDING_AUTH_KEY))
   },
   async savePending(pending: CloudAuthPending): Promise<void> {
     assertNativeCloudAuth()
-    await secureStorageReady
+    await secureStorageReady()
     await SecureStorage.setItem(PENDING_AUTH_KEY, JSON.stringify(pending))
   },
   async deletePending(): Promise<void> {
     if (!Capacitor.isNativePlatform()) return
-    await secureStorageReady
+    await secureStorageReady()
     await SecureStorage.removeItem(PENDING_AUTH_KEY)
   },
   async loadCredential(): Promise<unknown> {
     if (!Capacitor.isNativePlatform()) return null
-    await secureStorageReady
+    await secureStorageReady()
     const credential = migrateLegacyCloudCredential(
       parseStoredJson(await SecureStorage.getItem(CREDENTIAL_KEY))
     )
@@ -71,13 +114,13 @@ const storage: CloudAuthStorage = {
   },
   async saveCredential(credential: CloudAuthCredential): Promise<void> {
     assertNativeCloudAuth()
-    await secureStorageReady
+    await secureStorageReady()
     const canonicalCredential = migrateLegacyCloudCredential(credential).value
     await SecureStorage.setItem(CREDENTIAL_KEY, JSON.stringify(canonicalCredential))
   },
   async deleteCredential(): Promise<void> {
     if (!Capacitor.isNativePlatform()) return
-    await secureStorageReady
+    await secureStorageReady()
     await SecureStorage.removeItem(CREDENTIAL_KEY)
   }
 }

tooling/load-mobile-module.ts

@@ -23,6 +23,7 @@ export async function loadMobileModule(
     platform: 'node',
     format: 'cjs',
     write: false,
+    define: { 'import.meta.env': '{}' },
     plugins: [{
       name: 'mobile-test-boundaries',
       setup(plugin: any) {