accounts: stop a sign-in deleting anything, and scope the last unscoped save queries

Author: tmgast

app/src/main/kotlin/com/nendo/argosy/data/emulator/PlaySessionTracker.kt

@@ -755,7 +755,11 @@ class PlaySessionTracker @Inject constructor(
                 else -> null
             }
             linkCacheToServer(session.gameId, activeChannel, result, uploadedCacheId)
-            pendingSyncQueueDao.deleteActiveByGameAndType(session.gameId, com.nendo.argosy.data.local.entity.SyncType.SAVE_FILE)
+            pendingSyncQueueDao.deleteActiveByGameAndType(
+                session.gameId,
+                com.nendo.argosy.data.local.entity.SyncType.SAVE_FILE,
+                activeSaveRepository.activeOwnerId()
+            )
         }
 
         handleSaveSyncResult(session, game, result)

app/src/main/kotlin/com/nendo/argosy/data/local/dao/PendingSyncQueueDao.kt

@@ -24,6 +24,9 @@ interface PendingSyncQueueDao {
     @Query("SELECT * FROM pending_sync_queue WHERE gameId = :gameId")
     suspend fun getByGameId(gameId: Long): List<PendingSyncQueueEntity>
 
+    @Query("SELECT * FROM pending_sync_queue WHERE gameId = :gameId AND ownerUserId IS :ownerUserId")
+    suspend fun getByGameIdForOwner(gameId: Long, ownerUserId: Long?): List<PendingSyncQueueEntity>
+
     @Insert(onConflict = OnConflictStrategy.REPLACE)
     suspend fun insert(entity: PendingSyncQueueEntity): Long
 
@@ -33,11 +36,11 @@ interface PendingSyncQueueDao {
     @Query("DELETE FROM pending_sync_queue WHERE id = :id")
     suspend fun deleteById(id: Long)
 
-    @Query("DELETE FROM pending_sync_queue WHERE gameId = :gameId AND syncType = :syncType")
-    suspend fun deleteByGameAndType(gameId: Long, syncType: SyncType)
+    @Query("DELETE FROM pending_sync_queue WHERE gameId = :gameId AND syncType = :syncType AND ownerUserId IS :ownerUserId")
+    suspend fun deleteByGameAndType(gameId: Long, syncType: SyncType, ownerUserId: Long?)
 
-    @Query("DELETE FROM pending_sync_queue WHERE gameId = :gameId AND syncType = :syncType AND status IN ('PENDING', 'IN_PROGRESS')")
-    suspend fun deleteActiveByGameAndType(gameId: Long, syncType: SyncType)
+    @Query("DELETE FROM pending_sync_queue WHERE gameId = :gameId AND syncType = :syncType AND ownerUserId IS :ownerUserId AND status IN ('PENDING', 'IN_PROGRESS')")
+    suspend fun deleteActiveByGameAndType(gameId: Long, syncType: SyncType, ownerUserId: Long?)
 
     @Query("""
         UPDATE pending_sync_queue

app/src/main/kotlin/com/nendo/argosy/data/local/dao/SaveCacheDao.kt

@@ -157,8 +157,8 @@ interface SaveCacheDao {
      * ids name saves on a rom that no longer answers, and a pending upload against it can
      * only fail.
      */
-    @Query("UPDATE save_cache SET rommSaveId = NULL, needsRemoteSync = 0, remoteSyncError = NULL WHERE gameId = :gameId")
-    suspend fun clearRemoteLinkage(gameId: Long)
+    @Query("UPDATE save_cache SET rommSaveId = NULL, needsRemoteSync = 0, remoteSyncError = NULL WHERE gameId = :gameId AND ownerUserId IS :ownerUserId")
+    suspend fun clearRemoteLinkage(gameId: Long, ownerUserId: Long?)
 
     @Query("DELETE FROM save_cache WHERE gameId IN (SELECT id FROM games WHERE source IN (:sourceNames))")
     suspend fun deleteByGameSources(sourceNames: List<String>)
@@ -466,10 +466,11 @@ interface SaveCacheDao {
         SELECT EXISTS(
             SELECT 1 FROM save_cache
             WHERE gameId = :gameId AND isActive = 1 AND activeSaveApplied = 1
+              AND (ownerUserId IS NULL OR ownerUserId IS :ownerUserId)
         )
         """
     )
-    suspend fun hasActiveSaveApplied(gameId: Long): Boolean
+    suspend fun hasActiveSaveApplied(gameId: Long, ownerUserId: Long?): Boolean
 
     @Query("SELECT COUNT(*) FROM save_cache WHERE ownerUserId IS NULL")
     suspend fun countUnowned(): Int

app/src/main/kotlin/com/nendo/argosy/data/local/dao/SaveSyncDao.kt

@@ -143,6 +143,9 @@ interface SaveSyncDao {
     """)
     suspend fun clearCorruptZip(gameId: Long, emulatorId: String, channelName: String?, ownerUserId: Long?)
 
+    @Query("DELETE FROM save_sync WHERE gameId = :gameId AND ownerUserId IS :ownerUserId")
+    suspend fun deleteByGameForOwner(gameId: Long, ownerUserId: Long?)
+
     @Query("DELETE FROM save_sync WHERE gameId = :gameId")
     suspend fun deleteByGame(gameId: Long)
 

app/src/main/kotlin/com/nendo/argosy/data/preferences/AccountScopedPreferenceKeys.kt

@@ -10,7 +10,10 @@ import androidx.datastore.preferences.core.Preferences
  * single-store behaviour it had before accounts existed, so a key added elsewhere and forgotten
  * here degrades to "shared between accounts" rather than to "silently empty for everyone".
  *
- * Four groups are deliberately absent and must stay absent. `secure_saves` picks one save mode
+ * Five groups are deliberately absent and must stay absent. `sync_filter_delete_orphans` decides
+ * whether a sync may delete rows from `games`, which is one shared row per rom and carries a
+ * CASCADE onto every account's overlay; a per-account copy meant a newly added account read the
+ * `true` default and re-enabled cleanup the first account had turned off. `secure_saves` picks one save mode
  * for one shared save directory. `builtin_custom_save_path` and `builtin_custom_state_path`
  * define the resolved save path itself, so a per-account value would make teardown and placement
  * target different directories. The `active_session_*` keys are how an interrupted session is
@@ -41,8 +44,7 @@ object AccountScopedPreferenceKeys {
         "sync_filter_exclude_beta",
         "sync_filter_exclude_proto",
         "sync_filter_exclude_demo",
-        "sync_filter_exclude_hack",
-        "sync_filter_delete_orphans"
+        "sync_filter_exclude_hack"
     )
 
     private val DOWNLOAD_CATEGORIES = setOf(

app/src/main/kotlin/com/nendo/argosy/data/remote/romm/RomMConnectionManager.kt

@@ -7,6 +7,8 @@ import android.provider.Settings
 import com.nendo.argosy.BuildConfig
 import com.nendo.argosy.data.preferences.UserPreferencesRepository
 import com.nendo.argosy.data.repository.BiosRepository
+import com.nendo.argosy.data.sync.AccountRemovalResult
+import com.nendo.argosy.data.sync.UnflushedQueuePolicy
 import android.net.ConnectivityManager
 import android.net.Network
 import com.nendo.argosy.util.Logger
@@ -81,10 +83,11 @@ class RomMConnectionManager @Inject constructor(
     @ApplicationContext private val context: Context,
     private val userPreferencesRepository: UserPreferencesRepository,
     private val saveSyncRepository: dagger.Lazy<com.nendo.argosy.data.repository.SaveSyncRepository>,
-    private val databaseAdminRepository: dagger.Lazy<com.nendo.argosy.data.repository.DatabaseAdminRepository>,
-    private val saveCacheRepository: dagger.Lazy<com.nendo.argosy.data.repository.SaveCacheRepository>,
     private val biosRepository: BiosRepository,
     private val rommAccountRepository: dagger.Lazy<com.nendo.argosy.data.repository.RomMAccountRepository>,
+    private val accountRemovalService: dagger.Lazy<com.nendo.argosy.data.sync.AccountRemovalService>,
+    private val syncCoordinator: dagger.Lazy<com.nendo.argosy.data.sync.SyncCoordinator>,
+    private val retroAchievementsRepository: dagger.Lazy<com.nendo.argosy.data.repository.RetroAchievementsRepository>,
     private val apiFactory: RomMApiFactory
 ) {
     private var api: RomMApi? = null
@@ -200,38 +203,39 @@ class RomMConnectionManager @Inject constructor(
         })
     }
 
-    private fun normalizeServerKey(url: String): String =
-        url.trim().lowercase().removePrefix("https://").removePrefix("http://").trimEnd('/')
-
     private suspend fun fetchCurrentUser(target: RomMApi): RomMUser? = try {
         val response = target.getCurrentUser()
         if (response.isSuccessful) response.body() else null
     } catch (_: Exception) {
         null
     }
 
-    private suspend fun persistRommCredentials(newBaseUrl: String, token: String, user: RomMUser?) {
-        val stored = userPreferencesRepository.preferences.first()
-        val storedKey = stored.rommBaseUrl?.let { normalizeServerKey(it) }
-        val newKey = normalizeServerKey(newBaseUrl)
-        val storedUserId = stored.rommUserId
+    private fun normalizeServerKey(url: String): String =
+        url.trim().lowercase().removePrefix("https://").removePrefix("http://").trimEnd('/')
 
-        val serverChanged = !storedKey.isNullOrBlank() && storedKey != newKey
-        val userChanged = storedUserId != null && user != null && storedUserId != user.id
+    /**
+     * Refuses a sign-in that would put a second server's library alongside the first.
+     *
+     * Rom ids are only unique within one RomM instance, so two servers on one device collide on
+     * every id the library, saves and sync queues are keyed by. Accounts are the supported way to
+     * hold more than one identity, and they share the server the device is already registered to.
+     * Nothing is deleted here; the existing library stays exactly as it is and the sign-in simply
+     * does not happen.
+     */
+    private suspend fun requireSameServer(newBaseUrl: String) {
+        val accounts = rommAccountRepository.get().accounts()
+        val known = accounts.map { normalizeServerKey(it.baseUrl) }.filter { it.isNotBlank() }.toSet()
+        if (known.isEmpty()) return
+        val newKey = normalizeServerKey(newBaseUrl)
+        if (newKey in known) return
+        Logger.info(TAG, "persistRommCredentials: refused sign-in to $newKey, device is registered to ${known.joinToString()}")
+        throw IllegalStateException(
+            "This device is already signed in to a different RomM server. Remove the existing accounts before connecting to another server."
+        )
+    }
 
-        if (serverChanged || userChanged) {
-            val pendingUploads = saveCacheRepository.get().getPendingSyncCounts().pendingUploads
-            if (pendingUploads > 0) {
-                Logger.info(TAG, "persistRommCredentials: identity switch blocked, $pendingUploads saves pending upload")
-                throw IllegalStateException(
-                    "Sync saves first - $pendingUploads pending upload. Switching accounts would delete them."
-                )
-            }
-            val reason = if (serverChanged) "server changed ($storedKey -> $newKey)"
-                else "user changed ($storedUserId -> ${user?.id})"
-            Logger.info(TAG, "persistRommCredentials: $reason, purging RomM library")
-            databaseAdminRepository.get().purgeRomMLibrary()
-        }
+    private suspend fun persistRommCredentials(newBaseUrl: String, token: String, user: RomMUser?) {
+        requireSameServer(newBaseUrl)
         userPreferencesRepository.setRomMCredentials(newBaseUrl, token, user?.username, user?.id)
         if (user != null) {
             val stored = userPreferencesRepository.preferences.first()
@@ -548,15 +552,42 @@ class RomMConnectionManager @Inject constructor(
     }
 
     /**
-     * Forgets the stored RomM identity and tears down the live session. Library rows and
-     * downloaded content are left alone; signing back in as the same user reuses them, and
-     * signing in as a different user purges via [persistRommCredentials].
+     * Signs the active account out: its own rows, cached saves, preferences and credentials go,
+     * and nothing another account or the shared library owns is touched.
+     *
+     * This is removal aimed at the account that happens to be live, so it runs through the same
+     * service rather than a second, weaker path - that is what brings the switch-in-progress
+     * guard and the unflushed-work policy with it.
+     *
+     * The queue is drained first, while the token still authenticates. Everything the account
+     * cached and never sent can only be sent as that account, so an upload deferred past sign-out
+     * is an upload that never happens; refusing here is what keeps the local copy that is still
+     * the only copy. [discardUnflushed] gives up on whatever the drain could not deliver.
      */
-    suspend fun signOut() {
+    suspend fun signOut(discardUnflushed: Boolean = false): AccountRemovalResult {
+        val active = rommAccountRepository.get().activeAccount()
+            ?: run {
+                disconnect()
+                userPreferencesRepository.clearRomMCredentials()
+                return AccountRemovalResult.UnknownAccount
+            }
+        val drained = syncCoordinator.get().processQueue()
+        Logger.info(TAG, "signOut: drained queued work before removal, result=$drained")
+        val policy = if (discardUnflushed) {
+            UnflushedQueuePolicy.DISCARD
+        } else {
+            UnflushedQueuePolicy.REFUSE
+        }
+        val result = accountRemovalService.get().remove(active.id, policy)
+        if (result is AccountRemovalResult.Refused || result is AccountRemovalResult.SwitchInProgress) {
+            Logger.info(TAG, "signOut: not signed out, $result")
+            return result
+        }
         disconnect()
-        rommAccountRepository.get().activeAccount()?.let { rommAccountRepository.get().forget(it.id) }
         userPreferencesRepository.clearRomMCredentials()
-        Logger.info(TAG, "signOut: cleared stored RomM identity")
+        retroAchievementsRepository.get().syncRetroArchCredentials()
+        Logger.info(TAG, "signOut: removed user ${active.rommUserId} and cleared the stored identity")
+        return result
     }
 
     /**

app/src/main/kotlin/com/nendo/argosy/data/remote/romm/RomMLibrarySyncService.kt

@@ -424,7 +424,7 @@ class RomMLibrarySyncService @Inject constructor(
             }
 
             if (hasLocalContent(game)) {
-                preserveOrphanedGame(game)
+                preserveOrphanedGame(game, ownerUserId)
                 continue
             }
             gameDao.delete(game.id)
@@ -1257,7 +1257,7 @@ class RomMLibrarySyncService @Inject constructor(
             gameDao.insert(game.copy(rommId = successor.rommId, syncDirty = false))
             successor.rommId?.let { newRommId ->
                 saveSyncDao.realignToRommId(game.id, scope.ownerUserId, newRommId)
-                saveCacheDao.clearRemoteLinkage(game.id)
+                saveCacheDao.clearRemoteLinkage(game.id, scope.ownerUserId)
             }
             realigned++
             Logger.info(
@@ -1281,12 +1281,12 @@ class RomMLibrarySyncService @Inject constructor(
      * answers, and leaving them is what makes a device retry an upload against a dead id
      * for as long as the game exists. The cached saves themselves are never touched.
      */
-    private suspend fun preserveOrphanedGame(game: GameEntity) {
+    private suspend fun preserveOrphanedGame(game: GameEntity, ownerUserId: Long?) {
         val syntheticId = game.rommId?.takeIf { it < 0 } ?: -game.id
         gameDao.insert(game.copy(rommId = syntheticId, syncDirty = false))
         if (syntheticId != game.rommId) {
-            saveSyncDao.deleteByGame(game.id)
-            saveCacheDao.clearRemoteLinkage(game.id)
+            saveSyncDao.deleteByGameForOwner(game.id, ownerUserId)
+            saveCacheDao.clearRemoteLinkage(game.id, ownerUserId)
             Logger.info(
                 TAG,
                 "preserveOrphanedGame: ${game.title} has local content, rommId ${game.rommId} -> $syntheticId, dropped remote sync state"

app/src/main/kotlin/com/nendo/argosy/data/remote/romm/RomMRepository.kt

@@ -65,7 +65,8 @@ class RomMRepository @Inject constructor(
 
     fun disconnect() = connectionManager.disconnect()
 
-    suspend fun signOut() = connectionManager.signOut()
+    suspend fun signOut(discardUnflushed: Boolean = false) =
+        connectionManager.signOut(discardUnflushed)
 
     suspend fun checkConnection() = connectionManager.checkConnection()
 

app/src/main/kotlin/com/nendo/argosy/data/repository/ActiveSaveRepository.kt

@@ -34,7 +34,7 @@ class ActiveSaveRepository @Inject constructor(
         getActiveRow(gameId)?.cachedAt?.toEpochMilli()
 
     suspend fun isActiveSaveApplied(gameId: Long): Boolean =
-        saveCacheDao.hasActiveSaveApplied(gameId)
+        saveCacheDao.hasActiveSaveApplied(gameId, activeOwnerId())
 
     suspend fun getPendingDeviceSyncSaveId(gameId: Long): Long? =
         getActiveRow(gameId)?.pendingDeviceSyncSaveId

app/src/main/kotlin/com/nendo/argosy/data/repository/DatabaseAdminRepository.kt

@@ -75,13 +75,6 @@ class DatabaseAdminRepository @Inject constructor(
         true
     }
 
-    /** Wipes RomM-sourced library content AND its downloaded files so a server switch starts clean. */
-    suspend fun purgeRomMLibrary() = withContext(Dispatchers.IO) {
-        val sources = listOf(GameSource.ROMM_REMOTE, GameSource.ROMM_SYNCED)
-        deleteDownloadedFiles(sources)
-        purgeDatabase(sources, includeLocalCollections = false, clearImages = true)
-    }
-
     /** Resets the entire library database and per-game caches; downloaded ROM files stay on disk. */
     suspend fun purgeAllLibrary() = withContext(Dispatchers.IO) {
         deleteCacheDirs(GameSource.entries)