fix(android): bind retained documents to accounts

ROADMAP.md

@@ -256,6 +256,7 @@ DocumentsProvider alone is not advertised as sufficient for Obsidian until teste
 - Create, rename, move, copy, and delete update local state only after the remote result is known, or enter a visible pending/unknown state when the result is ambiguous.
 - `isChildDocument`, document path, recent, and search behavior are implemented and tested against the Android system picker.
 - App lock behavior is explicit: hiding roots is not enough if other apps retain URI grants. The security design documents which previously granted files remain readable and offers account removal/revocation guidance.
+- Account removal journals and commits a document-ID incarnation tombstone before deleting credentials. Credential recovery restores interrupted pre-commit retirements, while committed removals keep the tombstone. A later account with the same server and login receives new opaque IDs, so retained file and subtree grants cannot regain access.
 
 ### Acceptance criteria
 

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountCredentialTransitions.kt

@@ -20,7 +20,9 @@ internal suspend fun replaceAndroidActiveStateWithAccountLeases(
 ) {
     val replacementSession = requireNotNull(replacement.activeSession)
     val accountIdentities = listOfNotNull(previousSession, replacementSession, replacedSession)
-        .map(NextcloudDocumentIds::accountKey)
+        .flatMap(::androidAccountOperationIdentities)
+        .distinct()
+        .sorted()
     guard.withAccounts(accountIdentities) {
         quiesceAndroidFileRangesBeforeCredentialReplacement(replacedSession, replacementSession, coordinator)
         replace(replacement, previousSession, suspectEncrypted, replacedSession)
@@ -87,6 +89,17 @@ internal suspend fun resumeAndroidQueuedUploadsAfterSelection(
     }
 }
 
+internal fun notifyAndroidDocumentRootsAfterCommittedTransition(
+    notify: () -> Unit,
+    recordFailure: (Exception) -> Unit,
+) {
+    try {
+        notify()
+    } catch (failure: Exception) {
+        recordFailure(failure)
+    }
+}
+
 internal suspend fun removeAndroidAccountCredentialData(
     active: Boolean,
     prepareAccountRemoval: suspend () -> Unit = {},
@@ -95,6 +108,7 @@ internal suspend fun removeAndroidAccountCredentialData(
     rollbackActiveRemoval: suspend () -> Unit,
     persistInactiveRemoval: suspend () -> Unit,
     rollbackInactiveRemoval: suspend () -> Unit,
+    onInactiveRemovalCommitted: () -> Unit = {},
     completeCommittedCleanup: suspend () -> Unit = {},
     recordCommittedCleanupFailure: (Exception) -> Unit = {},
 ) {
@@ -126,6 +140,10 @@ internal suspend fun removeAndroidAccountCredentialData(
         }
         throw failure
     }
+    notifyAndroidDocumentRootsAfterCommittedTransition(
+        onInactiveRemovalCommitted,
+        recordCommittedCleanupFailure,
+    )
     finishCommittedAndroidAccountRemovalCleanup(
         removeQueuedUploads,
         completeCommittedCleanup,
@@ -141,6 +159,7 @@ internal suspend fun removeUnavailableAndroidAccountCredentialData(
     persistRemoval: suspend () -> Unit,
     clearActiveAccount: suspend () -> Unit = persistRemoval,
     rollbackRemoval: suspend () -> Unit,
+    onInactiveRemovalCommitted: () -> Unit = {},
     completeCommittedCleanup: suspend () -> Unit = {},
     recordCommittedCleanupFailure: (Exception) -> Unit = {},
 ) {
@@ -153,6 +172,7 @@ internal suspend fun removeUnavailableAndroidAccountCredentialData(
         rollbackActiveRemoval = rollbackRemoval,
         persistInactiveRemoval = persistRemoval,
         rollbackInactiveRemoval = rollbackRemoval,
+        onInactiveRemovalCommitted = onInactiveRemovalCommitted,
         completeCommittedCleanup = completeCommittedCleanup,
         recordCommittedCleanupFailure = recordCommittedCleanupFailure,
     )

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountFileRead.kt

@@ -64,6 +64,7 @@ internal class AndroidFileRangeSessionActivity {
 internal class AndroidFileRangeSessionCoordinator {
     private val monitor = Any()
     private val registrations = mutableMapOf<String, MutableSet<Registration>>()
+    private var credentialResetInProgress = false
 
     fun register(
         accountIdentity: String,
@@ -77,7 +78,10 @@ internal class AndroidFileRangeSessionCoordinator {
             whenDrained = activity::whenDrained,
             unregister = { unregister(accountIdentity, registration) },
         )
-        synchronized(monitor) { registrations.getOrPut(accountIdentity, ::linkedSetOf) += registration }
+        synchronized(monitor) {
+            check(!credentialResetInProgress) { "File range sessions are unavailable during credential reset." }
+            registrations.getOrPut(accountIdentity, ::linkedSetOf) += registration
+        }
         return registration
     }
 
@@ -88,6 +92,26 @@ internal class AndroidFileRangeSessionCoordinator {
         synchronized(monitor) { registrations.remove(accountIdentity) }
     }
 
+    suspend fun <Result> withAllQuiesced(action: suspend () -> Result): Result {
+        val current = synchronized(monitor) {
+            check(!credentialResetInProgress) { "A credential reset is already in progress." }
+            credentialResetInProgress = true
+            registrations.values.flatten()
+        }
+        return try {
+            current.forEach(Registration::cancel)
+            current.forEach { registration -> registration.awaitDrained() }
+            val completed = current.toSet()
+            synchronized(monitor) {
+                registrations.values.forEach { accountRegistrations -> accountRegistrations.removeAll(completed) }
+                registrations.entries.removeAll { (_, accountRegistrations) -> accountRegistrations.isEmpty() }
+            }
+            action()
+        } finally {
+            synchronized(monitor) { credentialResetInProgress = false }
+        }
+    }
+
     private fun unregister(accountIdentity: String, registration: Registration) = synchronized(monitor) {
         registrations[accountIdentity]?.let { current ->
             current -= registration
@@ -143,9 +167,12 @@ internal fun openTrackedAndroidFileRangeSession(
             throw FileNotFoundException("The account changed before the file range session could start.")
         }
         val source = openSource()
-        val registration = coordinator.register(
-            NextcloudDocumentIds.accountKey(expectedSession), activity, source::close,
-        )
+        val registration = try {
+            coordinator.register(NextcloudDocumentIds.accountKey(expectedSession), activity, source::close)
+        } catch (failure: Throwable) {
+            runCatching(source::close).exceptionOrNull()?.let(failure::addSuppressed)
+            throw failure
+        }
         NextcloudFileRangeSession(source.size, source::read, registration::close, activity::start)
     } catch (failure: Throwable) {
         activity.close()

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountOperationGuard.kt

@@ -34,6 +34,28 @@ internal class AndroidAccountOperationGuard {
         }
     }
 
+    suspend fun <Result> tryWithAccounts(
+        accountIds: Collection<String>,
+        unavailable: suspend () -> Result,
+        action: suspend () -> Result,
+    ): Result {
+        currentCoroutineContext().ensureActive()
+        val leases = mutableListOf<AndroidAccountOperationLease>()
+        accountIds.distinct().sorted().forEach { accountId ->
+            val lease = tryAcquire(accountId)
+            if (lease == null) {
+                leases.asReversed().forEach(AndroidAccountOperationLease::close)
+                return unavailable()
+            }
+            leases += lease
+        }
+        try {
+            return action()
+        } finally {
+            leases.asReversed().forEach(AndroidAccountOperationLease::close)
+        }
+    }
+
     suspend fun <Result> withAccounts(accountIds: Collection<String>, action: suspend () -> Result): Result {
         val leases = mutableListOf<AndroidAccountOperationLease>()
         try {
@@ -46,6 +68,17 @@ internal class AndroidAccountOperationGuard {
 
     fun acquireBlocking(accountId: String): AndroidAccountOperationLease = runBlocking { acquire(accountId) }
 
+    fun acquireBlocking(accountIds: Collection<String>): AndroidAccountOperationLease = runBlocking {
+        val leases = mutableListOf<AndroidAccountOperationLease>()
+        try {
+            accountIds.distinct().sorted().forEach { accountId -> leases += acquire(accountId) }
+            AndroidAccountOperationLease { leases.asReversed().forEach(AndroidAccountOperationLease::close) }
+        } catch (failure: Throwable) {
+            leases.asReversed().forEach(AndroidAccountOperationLease::close)
+            throw failure
+        }
+    }
+
     suspend fun <Result> withAccountSession(
         accountId: String,
         resolveSession: suspend () -> dev.obiente.nextcloudnative.app.NextcloudSession?,
@@ -127,6 +160,10 @@ internal class AndroidAccountOperationLease(
 
 internal val ANDROID_ACCOUNT_OPERATION_GUARD = AndroidAccountOperationGuard()
 
+internal fun androidAccountOperationIdentities(
+    session: dev.obiente.nextcloudnative.app.NextcloudSession,
+): Set<String> = setOf(NextcloudDocumentIds.accountKey(session), session.accountId.storageKey)
+
 internal fun androidAccountOperationSessionIsCurrent(
     expectedAccountId: String,
     currentSession: dev.obiente.nextcloudnative.app.NextcloudSession?,

androidApp/src/main/kotlin/dev/obiente/nextcloudnative/AndroidAccountOwnedStateCleanup.kt

@@ -53,7 +53,7 @@ internal class AndroidAccountOwnedStateCleanup(
                         legacyAndroidAccountPersistenceScopeDigest(session),
                     )
                 },
-                { revokeAndroidAccountDocumentGrants(appContext, accountIdentity) },
+                { revokeAndroidAccountDocumentGrants(appContext, accountIdentity, session.accountId.storageKey) },
                 { fileOffline.removeForAccount(accountIdentity) },
                 { incomingShares.removeForAccount(session) },
                 { durableUploads.removeForAccount(accountIdentity) },
@@ -96,7 +96,7 @@ internal class AndroidAccountOwnedStateCleanup(
                         legacyAccountScopeDigest,
                     )
                 },
-                { revokeAndroidAccountDocumentGrants(appContext, accountIdentity) },
+                { revokeAndroidAccountDocumentGrants(appContext, accountIdentity, session.accountId.storageKey) },
                 { fileOffline.removeForAccount(accountIdentity) },
                 { incomingShares.removeForAccount(accountIdentity, session) },
                 { durableUploads.removeForAccount(accountIdentity) },
@@ -139,7 +139,7 @@ internal class AndroidAccountOwnedStateCleanup(
                         legacyAccountScopeDigest,
                     )
                 },
-                { revokeAndroidAccountDocumentGrants(appContext, accountIdentity) },
+                { revokeAndroidAccountDocumentGrants(appContext, accountIdentity, accountStorageKey) },
                 { fileOffline.removeForAccount(accountIdentity) },
                 { incomingShares.removeForAccount(accountIdentity) },
                 { durableUploads.removeForAccount(accountIdentity) },