From 0ffdac0c461e504ea92afed9a45080819cec43c1 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 26 Jun 2026 11:47:31 -0700 Subject: Auto log-out also wipes a blank-password (unprotected) vault MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A vault saved with no password auto-unlocks on open, which would undo the sign-out. When a logout timer fires (or a boot is overdue), remove it too — only a password-protected vault survives. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/app.js | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'src/app.js') diff --git a/src/app.js b/src/app.js index 11fcefd..332a426 100644 --- a/src/app.js +++ b/src/app.js @@ -1026,6 +1026,7 @@ function applyBootAutoLogout() { try { sessionStorage.removeItem(ACCOUNTS_KEY); } catch {} try { localStorage.removeItem(WATCH_KEY); } catch {} clearWalletCaches(); + wipeBlankVault(); } // Remove every trace of the open wallet from this device: the session, the @@ -1039,11 +1040,21 @@ function clearWalletCaches() { } catch {} } +// A blank-password vault offers no protection and would auto-unlock on the next +// open, undoing the sign-out — so wipe it too. A password-protected vault stays. +function wipeBlankVault() { + const blob = loadVaultBlob(); + if (!blob) return; + try { decryptVault(blob, ''); } catch { return; } // needs a real password — keep it + try { localStorage.removeItem(VAULT_KEY); } catch {} +} + // Full sign-out after the app's been backgrounded past the limit. function autoLogout() { if (ui.screen !== 'wallet') return; // don't interrupt unlock / claim flows try { localStorage.removeItem(WATCH_KEY); } catch {} clearWalletCaches(); + wipeBlankVault(); lock(); // wipes the session + vault password and shows the unlock / vault screen } -- cgit v1.2.3