Web Lock Doesn't Truly Lock/Unload Database on Lock

[stevesbrain]

What happened?

With an app lock configured, on the web or desktop, on first app load, everything is encrypted correctly. After you unlock the app, and the app re-locks, the connection to the database is not unloaded properly, and your notes can still be queried.

I would expect an app lock would truly lock + unload.

Steps to reproduce the problem

To verify on first load that notes are encrypted/nothing retrievable:

1. Load up fresh/Ctrl+Shift+R a logged in session, with app lock enabled
2. Open dev console of your browser and run:

(async () => {
  const dbs = await indexedDB.databases();
  console.log("IndexedDB databases present:", dbs.map(d => d.name));

  // Dump the KeyStore's own secret store — this is where `databaseKey`,
  // `userEncryptionKey`, and `lockAfter` are kept (apps/web/src/interfaces/key-store.ts).
  const req = indexedDB.open("KeyChain-secrets");
  req.onsuccess = () => {
    const db = req.result;
    const tx = db.transaction("secrets", "readonly");
    const getAll = tx.objectStore("secrets").getAll();
    const getKeys = tx.objectStore("secrets").getAllKeys();
    getAll.onsuccess = () => {
      getKeys.onsuccess = () => {
        getKeys.result.forEach((k, i) => {
          console.log(`secret "${k}":`, getAll.result[i]);
        });
      };
    };
  };
})();

3. Result should be all unreadable bytes. Unlock, then go Dev Tools -> sources
4. Open wa-sqlite-kysely-drivers.ts and set a breakpoint on line 315 (currently - it's the executeQuery function of WaSqliteWorkerConnection)
5. Do something like open a note to trigger the breakpoint
6. Go to scope panel -> right click on variable "this" and store it as a global variable - like "temp1" or similar
7. Resume app + remove breakpoint if needed
8. Lock app
9. In the console, run: await temp1.worker.run("query", "select id, noteId, data, locked, dateEdited from content limit 5", [])
10. See all your notes/attachments data returned

Version

3.4.5-b5140d9-web

Platform/OS

Chrome/Chromium

Relevant log output

[stevesbrain]

Simple simulation of the fix to prove unload works properly as well, when called:

await temp1.worker.run("query", "select id, noteId, data, locked, dateEdited from content limit 40", [])
Object { rows: (20) […] }

await temp1.worker.close()
undefined

await temp1.worker.run("query", "select id, noteId, data, locked, dateEdited from content limit 40", [])
Waiting for database to be initialized... undefined

But some sort of check I think will need to be built into web app to re-load it on unlock too - unloading it this way doesn't detect it's been unloaded, so whilst it protects the data, it also kills the ability to use the app until force-reloaded.