From ad028dd1c61e41913e4628046b96bf162bc4ba4a Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Fri, 9 Oct 2026 10:13:48 -0700 Subject: Accounts: switching no longer leaks the previous identity's notifications and DMs into the next. A notifications query (up to 5 s on the relays) or a wrap mid-decrypt that was still out at the switch landed in the NEW account's list and was saved there under its key — a throwaway account showed adam's zaps, reactions and conversations for good. A session counter bumped in stop() is checked after every await on both paths; notifications only take events p-tagging this identity, and an incoming DM must come from or name it. Healing: notification caches saved before this (no notifsV 2) are dropped once and refetched; a cached DM thread holding a row from someone who is neither us nor the peer is swept. tools/account-switch-leak-test.js (fails on the old code: the reaction and the thread both leak) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01Vps2H27rhbG9ZqseGfMrc3 --- tools/notif-note-cache-test.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tools/notif-note-cache-test.js') diff --git a/tools/notif-note-cache-test.js b/tools/notif-note-cache-test.js index a3173fa..e24c2e2 100644 --- a/tools/notif-note-cache-test.js +++ b/tools/notif-note-cache-test.js @@ -93,7 +93,7 @@ try { const item = { id: 'a'.repeat(64), what: 'react', actor: actorPk, target: target.id, hint: [], emoji: '❤️', ts: now - 30 }; await page.evaluate(([key, owner, notification]) => { const state = JSON.parse(localStorage.getItem(key + ':messages') || '{}'); - state.notifs = [notification]; state.notifsPk = owner; + state.notifs = [notification]; state.notifsPk = owner; state.notifsV = 2; localStorage.setItem(key + ':messages', JSON.stringify(state)); }, [base, me, item]); await page.reload({ waitUntil: 'domcontentloaded' }); -- cgit v1.2.3