deleting an account breaks the app

[xyhhx]

im observing this for at least one function (sync), but presumably this will exhibit itself elsewhere:

steps to reproduce

1. create an account somewhere
2. log in on the app
3. set up a sync from the app
4. delete the account from anywhere other than the app
5. return to the app
   • observe that you've been logged out
   • also observe that sync notifications persist
6. create another account somewhere
7. log in on the app with the new account
8. go to set up a sync
   • observe that the app momentarily shows the old syncs
   • observe that the app crashes

this bug is expressed in both the mobile app and the desktop app

expected outcome

• the app should be aware of the account's deletion even while in the background, and log the user out
• when logging a user out, any settings that were maintained (including folder syncs) should be erased

actual outcomed

• the app only checks for account status when the app is brought to the foreground, and only logs a user out then
• the app doesn't clear any app data or settings when the user is logged out, and stuff such as folder syncs remain

other notes:

this is actually quite a serious vulnerability as a user who's identity has been compromised will leave traces of their use on devices. for example, if my phone has been compromised by adversaries, and i delete my account from the web app or desktop app, the phone will still persist data about me

[xyhhx]

as a workaround for those who can still access their phone: going to app info then deleting its storage will clear the persistent sync settings and let you use it on the new account

[ianopolous]

This is a bug, but not a vulnerability. The device is not logged in to sync. It has a write capability to the destination sync folder. That folder is, assuming sync has been running, exactly the same as the plain text local folder it is syncing with. So nothing is exposed that isn't already on the device in plaintext outside of peergos.