fix(realtime): handle base64 bytea payloads from postgres_changes

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.3.2",
+  "version": "0.3.5",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",

apps/desktop/src/context/AuthContext.tsx

@@ -61,7 +61,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
           const status = (error as { status?: number }).status;
           if (status === 401 || status === 403) {
             // Token genuinely invalid — wipe.
-            await supabase.auth.signOut().catch(() => {
+            await supabase.auth.signOut({ scope: 'local' }).catch(() => {
               /* ignore */
             });
             setSession(null);

apps/desktop/src/lib/secretStore.ts

@@ -39,11 +39,21 @@ export async function setSecretStoreUser(userId: string | null): Promise<void> {
 
   if (userId && isTauriRuntime()) {
     const stronghold = makeStrongholdStore(userId);
-    activeBackend = stronghold;
     try {
-      await migrateLocalStorageToStronghold(userId, PREFIX);
+      // Force a tiny round-trip to verify Stronghold can actually open the
+      // vault on this machine. If not (broken vault file, bundled rust crate
+      // mismatch, etc.) we fall back to localStorage so the rest of the app
+      // remains usable instead of bricking device registration.
+      await stronghold.getSecret('__probe');
+      activeBackend = stronghold;
+      try {
+        await migrateLocalStorageToStronghold(userId, PREFIX);
+      } catch (err: unknown) {
+        console.warn('stronghold migration failed', err);
+      }
     } catch (err: unknown) {
-      console.warn('stronghold migration failed', err);
+      console.warn('stronghold init failed — falling back to localStorage', err);
+      activeBackend = localStore;
     }
   } else {
     activeBackend = localStore;

apps/desktop/src/lib/useConversationMessages.ts

@@ -10,7 +10,7 @@ import {
   type MessageWithCipher,
   sendEncryptedMessage,
 } from '@chat-app/shared/chat';
-import { bytesToPgHex, pgHexToBytes } from '@chat-app/shared/supabase';
+import { bytesToPgHex, pgBytesToBytes } from '@chat-app/shared/supabase';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import { devLocalSecretStore } from './secretStore';
@@ -44,8 +44,8 @@ function rowToMessage(row: Record<string, unknown>): MessageWithCipher {
     editedAt: row.edited_at ? String(row.edited_at) : null,
     deletedAt: row.deleted_at ? String(row.deleted_at) : null,
     createdAt: String(row.created_at),
-    ciphertext: pgHexToBytes(String(row.ciphertext ?? '\\x')),
+    ciphertext: pgBytesToBytes(String(row.ciphertext ?? '\\x')),
-    nonce: pgHexToBytes(String(row.nonce ?? '\\x')),
+    nonce: pgBytesToBytes(String(row.nonce ?? '\\x')),
     keyVersion: typeof row.key_version === 'number' ? row.key_version : 1,
   };
 }

packages/shared/src/auth/magic-link.ts

@@ -86,7 +86,11 @@ export async function completeSessionFromUrl(
 }
 
 export async function signOut(client: AppSupabaseClient): Promise<void> {
-  const { error } = await client.auth.signOut();
+  // `scope: 'local'` only ends the session in THIS client. Without it Supabase
+  // defaults to 'global', which invalidates the user's refresh tokens
+  // everywhere — meaning a logout in the browser would also kick the desktop
+  // app (and vice versa) the next time it tries to refresh its token.
+  const { error } = await client.auth.signOut({ scope: 'local' });
   if (error) throw error;
 }
 

packages/shared/src/supabase/bytea.ts

@@ -23,3 +23,20 @@ export function pgHexToBytes(hex: string): Uint8Array {
   }
   return out;
 }
+
+// Accepts either:
+//   - PostgREST/REST `\x<hex>` strings (what the .from('table').select() path
+//     returns for bytea), or
+//   - Realtime `postgres_changes` payloads, which encode bytea as plain
+//     base64 (no `\x` prefix).
+// Useful when the same row can arrive through both paths in the same UI.
+export function pgBytesToBytes(value: string): Uint8Array {
+  if (value.startsWith('\\x')) {
+    return pgHexToBytes(value);
+  }
+  // Assume base64 (the realtime serializer's default for bytea).
+  const bin = atob(value);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}