fix(auth): scope signOut to local session only

apps/desktop/src-tauri/Cargo.toml

@@ -14,7 +14,7 @@ crate-type = ["staticlib", "cdylib", "rlib"]
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-tauri = { version = "2", features = [] }
+tauri = { version = "2", features = ["devtools"] }
 tauri-plugin-notification = "2"
 tauri-plugin-sql = { version = "2", features = ["sqlite"] }
 tauri-plugin-stronghold = "2"

apps/desktop/src-tauri/capabilities/default.json

@@ -15,6 +15,14 @@
     "updater:allow-check",
     "updater:allow-download",
     "updater:allow-install",
-    "updater:allow-download-and-install"
+    "updater:allow-download-and-install",
+    "stronghold:default",
+    "stronghold:allow-initialize",
+    "stronghold:allow-load-client",
+    "stronghold:allow-create-client",
+    "stronghold:allow-save",
+    "stronghold:allow-get-store-record",
+    "stronghold:allow-save-store-record",
+    "stronghold:allow-remove-store-record"
   ]
 }

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.3.0",
+  "version": "0.3.4",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",

apps/desktop/src/context/AuthContext.tsx

@@ -61,7 +61,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
           const status = (error as { status?: number }).status;
           if (status === 401 || status === 403) {
             // Token genuinely invalid — wipe.
-            await supabase.auth.signOut().catch(() => {
+            await supabase.auth.signOut({ scope: 'local' }).catch(() => {
               /* ignore */
             });
             setSession(null);

apps/desktop/src/lib/secretStore.ts

@@ -39,12 +39,22 @@ export async function setSecretStoreUser(userId: string | null): Promise<void> {
 
   if (userId && isTauriRuntime()) {
     const stronghold = makeStrongholdStore(userId);
+    try {
+      // Force a tiny round-trip to verify Stronghold can actually open the
+      // vault on this machine. If not (broken vault file, bundled rust crate
+      // mismatch, etc.) we fall back to localStorage so the rest of the app
+      // remains usable instead of bricking device registration.
+      await stronghold.getSecret('__probe');
       activeBackend = stronghold;
       try {
         await migrateLocalStorageToStronghold(userId, PREFIX);
       } catch (err: unknown) {
         console.warn('stronghold migration failed', err);
       }
+    } catch (err: unknown) {
+      console.warn('stronghold init failed — falling back to localStorage', err);
+      activeBackend = localStore;
+    }
   } else {
     activeBackend = localStore;
   }

packages/shared/src/auth/magic-link.ts

@@ -86,7 +86,11 @@ export async function completeSessionFromUrl(
 }
 
 export async function signOut(client: AppSupabaseClient): Promise<void> {
-  const { error } = await client.auth.signOut();
+  // `scope: 'local'` only ends the session in THIS client. Without it Supabase
+  // defaults to 'global', which invalidates the user's refresh tokens
+  // everywhere — meaning a logout in the browser would also kick the desktop
+  // app (and vice versa) the next time it tries to refresh its token.
+  const { error } = await client.auth.signOut({ scope: 'local' });
   if (error) throw error;
 }