thoughtsync/core/src/local/retention.rs

//! Trash retention for a device with no server (M11.3).
//!
//! The server owns this policy whenever there IS one: a linked client learns about
//! every permanent deletion from the delta feed, as a tombstone, and does exactly
//! what it's told. This module exists for the case the server can't cover — an
//! offline-only install, where trash would otherwise sit forever and the attachment
//! bytes with it.
//!
//! Which is why the sweep refuses to run while linked. If it didn't, a device could
//! decide on its own that a note had expired, destroy it, and then push that delete
//! upstream — overruling a server that was deliberately keeping it (retention off, or
//! a longer window than this constant). A client's local policy must never outrank
//! the server's.

use chrono::{DateTime, Duration, Utc};
use rusqlite::Connection;

use super::store;
use crate::sync::state;

/// The window an unlinked device uses. Matches the server's default so a device that
/// later links doesn't see its trash behave differently from one that always was.
pub const LOCAL_RETENTION_DAYS: i64 = 30;

/// Purge trash older than `retention_days`. Returns how many notes went.
///
/// `now` is a parameter so the window arithmetic is testable without waiting a month.
pub fn sweep_expired_trash(
    conn: &Connection,
    retention_days: i64,
    now: DateTime<Utc>,
) -> rusqlite::Result<usize> {
    if retention_days <= 0 {
        return Ok(0);
    }
    let cutoff = now - Duration::days(retention_days);
    let mut expired: Vec<String> = Vec::new();
    {
        let mut stmt = conn.prepare(
            "SELECT id, trashed_at FROM notes WHERE trashed = 1 AND trashed_at IS NOT NULL",
        )?;
        let mut rows = stmt.query([])?;
        while let Some(row) = rows.next()? {
            let id: String = row.get(0)?;
            let stamped: String = row.get(1)?;
            // PARSED, not string-compared. The server writes `+00:00` offsets and this
            // client writes `Z`, so two timestamps for the same instant don't sort
            // against each other as text — and the failure would be silent.
            //
            // An unparseable stamp means "age unknown", and the only safe reading of
            // that is to keep the note. Deleting on a guess is the one outcome nobody
            // can undo.
            let Ok(trashed_at) = DateTime::parse_from_rfc3339(&stamped) else {
                continue;
            };
            if trashed_at.with_timezone(&Utc) < cutoff {
                expired.push(id);
            }
        }
    }
    for id in &expired {
        // Through delete_forever, so a `pending_deletes` tombstone is recorded. That's
        // right even here: while unlinked this device holds the only copy, so if it
        // links later the server should learn the note was deleted, not re-send it.
        store::delete_forever(conn, id)?;
    }
    Ok(expired.len())
}

/// The startup sweep: runs only on an unlinked device (see the module note).
/// Returns `None` when it didn't run because the device is linked.
pub fn sweep_if_unlinked(conn: &Connection) -> rusqlite::Result<Option<usize>> {
    if state::read(conn)?.server_url.is_some() {
        return Ok(None);
    }
    sweep_expired_trash(conn, LOCAL_RETENTION_DAYS, Utc::now()).map(Some)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::local::schema;

    fn db() -> Connection {
        let conn = Connection::open_in_memory().expect("in-memory db");
        schema::migrate(&conn).expect("migrate");
        conn
    }

    /// A trashed note of a given age, stamped in the format the CLIENT writes
    /// (`...Z`, millisecond precision — see `store::now`).
    fn trashed_note_aged(conn: &Connection, id: &str, age: Duration) {
        let when = Utc::now() - age;
        let stamped = when.to_rfc3339_opts(chrono::SecondsFormat::Millis, true);
        conn.execute(
            "INSERT INTO notes (id, body, created_at, updated_at, trashed, trashed_at)
             VALUES (?1, 'B', ?2, ?2, 1, ?2)",
            rusqlite::params![id, stamped],
        )
        .expect("insert");
    }

    fn trashed_note(conn: &Connection, id: &str, days_ago: i64) {
        trashed_note_aged(conn, id, Duration::days(days_ago));
    }

    fn sweep(conn: &Connection, days: i64) -> usize {
        sweep_expired_trash(conn, days, Utc::now()).expect("sweep")
    }

    fn note_count(conn: &Connection) -> i64 {
        conn.query_row("SELECT COUNT(*) FROM notes", [], |r| r.get(0))
            .expect("count")
    }

    #[test]
    fn purges_trash_past_the_window_and_keeps_the_rest() {
        let conn = db();
        trashed_note(&conn, "old", 40);
        trashed_note(&conn, "fresh", 3);
        let purged = sweep(&conn, 30);
        assert_eq!(purged, 1);
        assert_eq!(note_count(&conn), 1, "only the expired note should go");
    }

    #[test]
    fn a_note_just_inside_the_window_survives() {
        // The comparison is STRICTLY older than the cutoff, so a note with a minute
        // of its 30 days still to run is kept. An exact tie isn't testable against a
        // wall clock — the sweep reads `now` microseconds after the row is stamped,
        // which is precisely how the first version of this test failed.
        let conn = db();
        let almost = Duration::days(30) - Duration::minutes(1);
        trashed_note_aged(&conn, "boundary", almost);
        assert_eq!(sweep(&conn, 30), 0);
        assert_eq!(note_count(&conn), 1);
    }

    #[test]
    fn retention_off_purges_nothing() {
        let conn = db();
        trashed_note(&conn, "ancient", 4000);
        assert_eq!(sweep(&conn, 0), 0);
        assert_eq!(sweep(&conn, -1), 0);
        assert_eq!(note_count(&conn), 1);
    }

    #[test]
    fn an_untrashed_note_is_never_swept() {
        let conn = db();
        conn.execute(
            "INSERT INTO notes (id, body, created_at, updated_at, trashed)
             VALUES ('live', 'B', '2020-01-01T00:00:00.000Z', '2020-01-01T00:00:00.000Z', 0)",
            [],
        )
        .expect("insert");
        assert_eq!(sweep(&conn, 30), 0);
        assert_eq!(note_count(&conn), 1);
    }

    #[test]
    fn an_unparseable_timestamp_keeps_the_note() {
        // "Age unknown" must never resolve to "delete it".
        let conn = db();
        conn.execute(
            "INSERT INTO notes (id, body, created_at, updated_at, trashed, trashed_at)
             VALUES ('weird', 'B', '2020-01-01T00:00:00.000Z', '2020-01-01T00:00:00.000Z', 1, 'not a date')",
            [],
        )
        .expect("insert");
        assert_eq!(sweep(&conn, 30), 0);
        assert_eq!(note_count(&conn), 1);
    }

    #[test]
    fn a_server_style_offset_timestamp_is_understood() {
        // The server serializes with a `+00:00` offset, not `Z`. Comparing those as
        // strings would quietly never match — this is the case that catches it.
        let conn = db();
        let stamped = (Utc::now() - Duration::days(40)).to_rfc3339();
        conn.execute(
            "INSERT INTO notes (id, body, created_at, updated_at, trashed, trashed_at)
             VALUES ('server', 'B', ?1, ?1, 1, ?1)",
            rusqlite::params![stamped],
        )
        .expect("insert");
        assert_eq!(sweep(&conn, 30), 1);
    }

    #[test]
    fn a_purged_note_leaves_a_pending_delete_behind() {
        // Without the tombstone, linking this device later would let the server
        // re-send a note the user already destroyed here.
        let conn = db();
        trashed_note(&conn, "old", 40);
        sweep(&conn, 30);
        let pending: i64 = conn
            .query_row(
                "SELECT COUNT(*) FROM pending_deletes WHERE entity = 'note' AND id = 'old'",
                [],
                |r| r.get(0),
            )
            .expect("count");
        assert_eq!(pending, 1);
    }

    #[test]
    fn a_linked_device_does_not_sweep() {
        // The whole safety rule: with a server present, purging is the server's call.
        let conn = db();
        trashed_note(&conn, "old", 400);
        state::set_link(&conn, "https://notes.example", "token").expect("link");
        assert_eq!(sweep_if_unlinked(&conn).expect("sweep"), None);
        assert_eq!(
            note_count(&conn),
            1,
            "the note must survive on a linked device"
        );
    }

    #[test]
    fn an_unlinked_device_sweeps() {
        let conn = db();
        trashed_note(&conn, "old", 400);
        assert_eq!(sweep_if_unlinked(&conn).expect("sweep"), Some(1));
        assert_eq!(note_count(&conn), 0);
    }
}