A cache directory used by two accounts mixes their data. MetadataStore.load (src/library/store.ts:77-116) never checks the stored userID. Library.open (src/library/index.ts:348) loads it whatever it holds, and the first refresh only overwrites the field (src/library/index.ts:682). It keeps the other account's collections, files, keys and collectionsSinceTime cursor. The ML store in mldata/ (src/library/index.ts:362) is not keyed by account either.
Example: quak --cache-dir ~/q collections as account A, then logout, login as account B, and the same command again. B's refresh starts from A's cursor, so B's older albums never appear, while A's albums are listed as B's. The default cache path includes the user ID, so this needs --cache-dir or a library caller passing cacheDirectory. Both are documented.
Definition of done
When the loaded metadata.json belongs to a different, non-zero userID than the client, Library.open starts from an empty store. The ML data under mldata/ is discarded too.
A test opens a cache written for one user ID with a client for another, and shows that none of the first account's collections, files or ML results are visible and that enumeration starts from 0.
make check green; TODO.md updated in the same commit.
Model: opus-5-5
## Problem
A cache directory used by two accounts mixes their data. `MetadataStore.load` (`src/library/store.ts:77-116`) never checks the stored `userID`. `Library.open` (`src/library/index.ts:348`) loads it whatever it holds, and the first refresh only overwrites the field (`src/library/index.ts:682`). It keeps the other account's collections, files, keys and `collectionsSinceTime` cursor. The ML store in `mldata/` (`src/library/index.ts:362`) is not keyed by account either.
Example: `quak --cache-dir ~/q collections` as account A, then `logout`, `login` as account B, and the same command again. B's refresh starts from A's cursor, so B's older albums never appear, while A's albums are listed as B's. The default cache path includes the user ID, so this needs `--cache-dir` or a library caller passing `cacheDirectory`. Both are documented.
## Definition of done
1. When the loaded `metadata.json` belongs to a different, non-zero `userID` than the client, `Library.open` starts from an empty store. The ML data under `mldata/` is discarded too.
2. A test opens a cache written for one user ID with a client for another, and shows that none of the first account's collections, files or ML results are visible and that enumeration starts from 0.
3. `make check` green; `TODO.md` updated in the same commit.
Model: opus-5-5
clawbot
self-assigned this 2026-09-23 05:34:58 +02:00
Implemented in #113: Library.open deletes metadata.json and mldata/ and starts empty when the stored user ID is non-zero and differs from the client's. Cached originals and thumbnails are kept, and they can only be reached through the current account's records.
Model: opus-5-5
Implemented in https://git.eeqj.de/sneak/quak/pulls/113: `Library.open` deletes `metadata.json` and `mldata/` and starts empty when the stored user ID is non-zero and differs from the client's. Cached originals and thumbnails are kept, and they can only be reached through the current account's records.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Problem
A cache directory used by two accounts mixes their data.
MetadataStore.load(src/library/store.ts:77-116) never checks the storeduserID.Library.open(src/library/index.ts:348) loads it whatever it holds, and the first refresh only overwrites the field (src/library/index.ts:682). It keeps the other account's collections, files, keys andcollectionsSinceTimecursor. The ML store inmldata/(src/library/index.ts:362) is not keyed by account either.Example:
quak --cache-dir ~/q collectionsas account A, thenlogout,loginas account B, and the same command again. B's refresh starts from A's cursor, so B's older albums never appear, while A's albums are listed as B's. The default cache path includes the user ID, so this needs--cache-diror a library caller passingcacheDirectory. Both are documented.Definition of done
metadata.jsonbelongs to a different, non-zerouserIDthan the client,Library.openstarts from an empty store. The ML data undermldata/is discarded too.make checkgreen;TODO.mdupdated in the same commit.Model: opus-5-5
Implemented in #113:
Library.opendeletesmetadata.jsonandmldata/and starts empty when the stored user ID is non-zero and differs from the client's. Cached originals and thumbnails are kept, and they can only be reached through the current account's records.Model: opus-5-5