added support for multiple accounts with an account switcher in settings

lib/session/account_codec.dart

@@ -0,0 +1,218 @@
+import 'dart:convert';
+
+import 'session.dart';
+import 'session_codec.dart';
+
+/// One signed-in account on this device. The session itself lives in the
+/// keychain (active slots or the account's vault); this is the index entry.
+class AccountEntry {
+  final String id;
+  final String kind;
+
+  /// Login name — the identity of the account.
+  final String label;
+
+  /// Real name as known to the server; null until it was loaded once.
+  final String? displayName;
+  final bool isDemo;
+
+  /// Storage namespace of the account's local data. Empty for the account that
+  /// existed before multi-account support, so its data stays where it was.
+  final String namespace;
+  final int lastUsed;
+
+  const AccountEntry({
+    required this.id,
+    required this.kind,
+    required this.label,
+    required this.namespace,
+    this.displayName,
+    this.isDemo = false,
+    this.lastUsed = 0,
+  });
+
+  AccountEntry copyWith({int? lastUsed, String? displayName}) => AccountEntry(
+    id: id,
+    kind: kind,
+    label: label,
+    namespace: namespace,
+    displayName: displayName ?? this.displayName,
+    isDemo: isDemo,
+    lastUsed: lastUsed ?? this.lastUsed,
+  );
+
+  Map<String, dynamic> toJson() => {
+    'id': id,
+    'kind': kind,
+    'label': label,
+    'namespace': namespace,
+    'displayName': displayName,
+    'isDemo': isDemo,
+    'lastUsed': lastUsed,
+  };
+
+  static AccountEntry? fromJson(Object? json) {
+    if (json is! Map) return null;
+    final id = json['id'];
+    final kind = json['kind'];
+    final label = json['label'];
+    if (id is! String || kind is! String || label is! String) return null;
+    return AccountEntry(
+      id: id,
+      kind: kind,
+      label: label,
+      namespace: json['namespace'] is String ? json['namespace'] as String : id,
+      displayName: json['displayName'] is String
+          ? json['displayName'] as String
+          : null,
+      isDemo: json['isDemo'] == true,
+      lastUsed: json['lastUsed'] is int ? json['lastUsed'] as int : 0,
+    );
+  }
+}
+
+class AccountIndex {
+  final List<AccountEntry> accounts;
+  final String? activeId;
+
+  const AccountIndex({this.accounts = const [], this.activeId});
+
+  static const empty = AccountIndex();
+
+  AccountEntry? get active => byId(activeId);
+
+  AccountEntry? byId(String? id) {
+    if (id == null) return null;
+    for (final entry in accounts) {
+      if (entry.id == id) return entry;
+    }
+    return null;
+  }
+
+  /// The entry [session] belongs to — same kind, identity and demo flag.
+  AccountEntry? matching(Session session) {
+    final (kind, label) = identityOf(session);
+    for (final entry in accounts) {
+      if (entry.kind == kind &&
+          entry.label == label &&
+          entry.isDemo == session.isDemo) {
+        return entry;
+      }
+    }
+    return null;
+  }
+
+  /// Makes [session] the active account, reusing its entry when it is already
+  /// known and otherwise adding one with [newId] (also its namespace).
+  AccountIndex activate(
+    Session session, {
+    required String newId,
+    String? namespace,
+    int now = 0,
+  }) {
+    final existing = matching(session);
+    if (existing != null) return select(existing.id, now: now);
+    final (kind, label) = identityOf(session);
+    return AccountIndex(
+      accounts: [
+        ...accounts,
+        AccountEntry(
+          id: newId,
+          kind: kind,
+          label: label,
+          namespace: namespace ?? newId,
+          isDemo: session.isDemo,
+          lastUsed: now,
+        ),
+      ],
+      activeId: newId,
+    );
+  }
+
+  AccountIndex select(String id, {int now = 0}) => AccountIndex(
+    accounts: accounts
+        .map((e) => e.id == id ? e.copyWith(lastUsed: now) : e)
+        .toList(),
+    activeId: id,
+  );
+
+  AccountIndex rename(String id, String displayName) => AccountIndex(
+    accounts: accounts
+        .map((e) => e.id == id ? e.copyWith(displayName: displayName) : e)
+        .toList(),
+    activeId: activeId,
+  );
+
+  /// Drops [id]; the active account is left unset when it was the one removed.
+  AccountIndex remove(String id) => AccountIndex(
+    accounts: [
+      for (final e in accounts)
+        if (e.id != id) e,
+    ],
+    activeId: activeId == id ? null : activeId,
+  );
+
+  /// Most recently used account other than [excludedId], if any.
+  AccountEntry? mostRecentExcept(String? excludedId) {
+    AccountEntry? best;
+    for (final entry in accounts) {
+      if (entry.id == excludedId) continue;
+      if (best == null || entry.lastUsed > best.lastUsed) best = entry;
+    }
+    return best;
+  }
+
+  String encode() => jsonEncode({
+    'activeId': activeId,
+    'accounts': [for (final e in accounts) e.toJson()],
+  });
+
+  static AccountIndex decode(String? raw) {
+    if (raw == null || raw.isEmpty) return empty;
+    try {
+      final json = jsonDecode(raw);
+      if (json is! Map) return empty;
+      final list = json['accounts'];
+      return AccountIndex(
+        accounts: [
+          if (list is List)
+            for (final item in list) ?AccountEntry.fromJson(item),
+        ],
+        activeId: json['activeId'] is String
+            ? json['activeId'] as String
+            : null,
+      );
+    } on FormatException {
+      return empty;
+    }
+  }
+}
+
+(String kind, String label) identityOf(Session session) => switch (session) {
+  CredentialSession(:final username) => (SessionKeys.kindCredential, username),
+};
+
+/// Keychain fields of [session] including the app passwords, as stored in an
+/// inactive account's vault. Unset fields are omitted.
+Map<String, String> sessionVaultFields(Session session) => {
+  for (final MapEntry(:key, :value) in encodeSessionFields(session).entries)
+    key: ?value,
+  SessionKeys.appPassword: ?session.nextcloud?.appPassword,
+  SessionKeys.appPasswordTalk: ?session.nextcloud?.appPasswordTalk,
+};
+
+String encodeVault(Map<String, String> fields) => jsonEncode(fields);
+
+Map<String, String> decodeVault(String? raw) {
+  if (raw == null || raw.isEmpty) return const {};
+  try {
+    final json = jsonDecode(raw);
+    if (json is! Map) return const {};
+    return {
+      for (final MapEntry(:key, :value) in json.entries)
+        if (key is String && value is String) key: value,
+    };
+  } on FormatException {
+    return const {};
+  }
+}

lib/session/session_lifecycle.dart

@@ -1,22 +1,36 @@
+import 'dart:async';
 import 'dart:developer';
 
 import 'package:flutter/foundation.dart';
 
+import '../api/marianumcloud/app_password/delete_app_password.dart';
+import '../api/marianumconnect/auth/auth_interceptor.dart';
+import '../api/marianumconnect/auth/token_storage.dart';
 import '../api/marianumconnect/queries/auth_logout/auth_logout.dart';
+import '../api/marianumconnect/queries/auth_me/auth_me.dart';
+import '../background/widget_background_task.dart';
+import '../model/session_wipe.dart';
 import '../push/push_registration.dart';
+import '../storage/account_storage.dart';
+import '../widget_data/widget_sync.dart';
+import 'session.dart';
 import 'session_manager.dart';
 
 abstract final class SessionLifecycle {
   /// Why the last sign-out happened, when the user did not ask for it. The
-  /// login screen shows it once and clears it — without it an expired session
-  /// just drops the user on the login screen with no explanation.
+  /// login screen (or, when another account takes over, the app) shows it
+  /// once and clears it.
   static final ValueNotifier<String?> signOutNotice = ValueNotifier(null);
 
+  /// Account to return to while "add account" runs; null otherwise.
+  static String? _addReturnId;
+
   /// Ordered teardown: unregister push and revoke the Nextcloud app passwords
   /// (while those credentials still exist), then revoke the MC bearer token,
-  /// finally wipe the local session. Each step is best-effort so an offline
-  /// sign-out still reaches a clean local state.
-  static Future<void> signOut({String? notice}) async {
+  /// finally wipe the local session and its data. Each step is best-effort so
+  /// an offline sign-out still reaches a clean local state. Another signed-in
+  /// account takes over when there is one; returns its id.
+  static Future<String?> signOut({String? notice}) async {
     signOutNotice.value = notice;
     try {
       await PushRegistration().logoutCleanup();
@@ -24,6 +38,166 @@ abstract final class SessionLifecycle {
       log('Sign-out: push cleanup failed: $e');
     }
     await AuthLogout().run();
-    await SessionManager().signOut();
+    final removed = await SessionManager().signOut();
+    SessionWipe.clearImmediate();
+    await SessionWipe.accountLeft();
+    if (removed != null) await AccountStorage.delete(removed.namespace);
+
+    for (
+      var next = SessionManager().accounts.value.mostRecentExcept(null);
+      next != null;
+      next = SessionManager().accounts.value.mostRecentExcept(null)
+    ) {
+      try {
+        await SessionManager().activate(next.id);
+        break;
+      } on Object catch (e) {
+        log('Sign-out: taking over ${next.id} failed: $e');
+        await SessionManager().forget(next.id);
+      }
+    }
+    await AccountStorage.activate(SessionManager().activeAccount);
+    if (SessionManager().isSignedIn) await _resetWidget();
+    return SessionManager().activeAccount?.id;
+  }
+
+  /// Makes the stored account [id] the active one. Push moves along: the
+  /// previous account is unregistered here, the new one registers once the
+  /// app has remounted for it.
+  static Future<void> switchTo(String id) async {
+    final previous = SessionManager().activeAccount;
+    if (previous?.id == id) return;
+    await MarianumConnectAuthInterceptor.idle();
+    try {
+      await PushRegistration().deactivate();
+    } on Object catch (e) {
+      log('Switch: push deactivation failed: $e');
+    }
+    await SessionManager().stashActive();
+    SessionWipe.clearImmediate();
+    var restored = false;
+    try {
+      await SessionManager().activate(id);
+    } on Object {
+      if (previous != null) {
+        await SessionManager().activate(previous.id);
+        restored = true;
+      }
+      rethrow;
+    } finally {
+      await SessionWipe.accountLeft();
+      await AccountStorage.activate(SessionManager().activeAccount);
+      // Nothing remounts for the account that stays, so its push would
+      // remain unregistered until the next start.
+      if (restored) unawaited(PushRegistration().register());
+    }
+    await _resetWidget();
+  }
+
+  /// Parks the active account before the login screen signs in another one.
+  static Future<void> beginAddAccount() async {
+    await SessionManager().stashActive();
+    _addReturnId = SessionManager().activeAccount?.id;
+    SessionWipe.clearImmediate();
+    // Whatever runs behind the login screen must not write into the parked
+    // account's data.
+    await AccountStorage.activate(null);
+  }
+
+  static bool get isAddingAccount => _addReturnId != null;
+
+  /// Leaves "add account" without a new account: a half-finished sign-in is
+  /// dropped and the previous account restored.
+  static Future<void> cancelAddAccount() async {
+    final returnId = _addReturnId;
+    _addReturnId = null;
+    if (returnId == null) return;
+    if (SessionManager().activeAccount?.id != returnId &&
+        SessionManager().isSignedIn) {
+      await SessionManager().signOut();
+    }
+    await SessionManager().activate(returnId);
+    await AccountStorage.activate(SessionManager().activeAccount);
+  }
+
+  /// Called once a login finished. After "add account" the previous account's
+  /// push is unregistered with its own credentials before the new one takes
+  /// over. Returns the id of the now active account.
+  static Future<String> finishLogin() async {
+    final returnId = _addReturnId;
+    _addReturnId = null;
+    final added = SessionManager().activeAccount!;
+    if (returnId != null && returnId != added.id) {
+      await SessionManager().stashActive();
+      await SessionManager().activate(returnId);
+      try {
+        await PushRegistration().deactivate();
+      } on Object catch (e) {
+        log('Add account: push deactivation failed: $e');
+      }
+      await SessionManager().activate(added.id);
+      await SessionWipe.accountLeft();
+    }
+    await AccountStorage.activate(SessionManager().activeAccount);
+    return added.id;
+  }
+
+  /// Refreshes the stored real name of the active account (best-effort).
+  static Future<void> refreshDisplayName() async {
+    if (SessionManager().current case final session? when !session.isDemo) {
+      try {
+        final user = await AuthMe().user();
+        final name = '${user.firstName} ${user.lastName}'.trim();
+        if (name.isNotEmpty) await SessionManager().setDisplayName(name);
+      } on Object catch (e) {
+        log('Display name refresh failed: $e');
+      }
+    }
+  }
+
+  /// Signs out an account that is not active: revokes its tokens with the
+  /// stored credentials (best-effort) and deletes its local data. Its push
+  /// was already unregistered when it stopped being active.
+  static Future<void> removeInactive(String id) async {
+    final entry = SessionManager().accounts.value.byId(id);
+    if (entry == null || entry.id == SessionManager().activeAccount?.id) return;
+    final (session, fields) = await SessionManager().readVault(id);
+    if (session != null && !session.isDemo) {
+      await _revoke(session, fields[MarianumConnectTokenStorage.bearerKey]);
+    }
+    await SessionManager().forget(id);
+    await AccountStorage.delete(entry.namespace);
+  }
+
+  static Future<void> _revoke(Session session, String? token) async {
+    if (token != null && token.isNotEmpty) await AuthLogout.revoke(token);
+    final nextcloud = session.nextcloud;
+    if (nextcloud == null) return;
+    try {
+      if (nextcloud.hasAppPassword) {
+        await DeleteAppPassword().run(
+          authorizationHeader: nextcloud.basicAuthHeader,
+        );
+      }
+      if (nextcloud.hasAppPasswordTalk) {
+        await DeleteAppPassword().run(
+          authorizationHeader: nextcloud.talkBasicAuthHeader,
+        );
+      }
+    } on Object catch (e) {
+      log('Remove account: app password revoke failed: $e');
+    }
+  }
+
+  /// The widget still shows the previous account's plan; the app republishes
+  /// once it mounted, the refresh covers a backgrounded app.
+  static Future<void> _resetWidget() async {
+    try {
+      await WidgetSync.clear();
+      await WidgetSync.triggerUpdate();
+      unawaited(WidgetBackgroundTask.requestImmediateRefresh());
+    } on Object catch (e) {
+      log('Widget reset failed: $e');
+    }
   }
 }

lib/session/session_manager.dart

@@ -2,17 +2,26 @@ import 'dart:async';
 import 'dart:developer';
 import 'dart:io';
 
+import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:shared_preferences/shared_preferences.dart';
 
+import '../api/marianumconnect/auth/token_storage.dart';
 import '../push/push_secure_storage.dart';
 import '../utils/exponential_backoff.dart';
+import '../utils/random_id.dart';
+import 'account_codec.dart';
 import 'nextcloud_credentials.dart';
 import 'session.dart';
 import 'session_codec.dart';
 
 /// Owns the active [Session] and its persistence. One instance per isolate;
 /// the widget background isolate reads the same keychain.
+///
+/// Several accounts can be signed in; the frozen [SessionKeys] slots, the MC
+/// token and the group-keychain app passwords always hold the *active* one
+/// (native code and the background isolate read only those). Inactive
+/// accounts are parked in a per-account vault entry.
 class SessionManager {
   // `first_unlock` so a background launch on a locked device (silent push,
   // BGAppRefresh) can still read the session. Items written by older versions
@@ -32,6 +41,10 @@ class SessionManager {
     SessionKeys.loginFlow,
   ];
 
+  static const _indexKey = 'accounts_index';
+  static String _vaultKey(String id) => 'account_vault_$id';
+  static const _tokenStorage = MarianumConnectTokenStorage();
+
   static final SessionManager _instance = SessionManager._();
   factory SessionManager() => _instance;
 
@@ -46,7 +59,8 @@ class SessionManager {
 
   int _sessionEpoch = 0;
 
-  /// Bumped whenever the signed-in account changes. Async work captures it when it starts and drops its
+  /// Bumped whenever the active account changes (sign-out, switch, another
+  /// account signing in). Async work captures it when it starts and drops its
   /// result when it changed meanwhile, so a request of the previous account
   /// cannot land in the next account's state or cache.
   int get sessionEpoch => _sessionEpoch;
@@ -58,6 +72,13 @@ class SessionManager {
   /// Called from `main()`; background entry points never run it.
   void markUiEngine() => _isUiEngine = true;
 
+  /// Every signed-in account and which one is active.
+  final ValueNotifier<AccountIndex> accounts = ValueNotifier(
+    AccountIndex.empty,
+  );
+
+  AccountEntry? get activeAccount => accounts.value.active;
+
   bool get isSignedIn => _current != null;
 
   bool get isDemo => _current?.isDemo ?? false;
@@ -85,8 +106,22 @@ class SessionManager {
   NextcloudCredentials requireNextcloud() =>
       _current?.nextcloud ?? (throw const NextcloudUnavailableException());
 
-  /// Replaces any stored session completely; no prior [signOut] needed.
+  /// Makes [session] the active account, replacing the active slots
+  /// completely. An account signed in before keeps its entry; call
+  /// [stashActive] first so the previously active one stays switchable.
   Future<void> signIn(Session session) async {
+    await _writeActive(session);
+    await _saveIndex(
+      accounts.value.activate(
+        session,
+        newId: randomHexId(bytes: 8),
+        now: _now(),
+      ),
+    );
+    if (!_loaded.isCompleted) _loaded.complete();
+  }
+
+  Future<void> _writeActive(Session session) async {
     if (!_isSameAccount(_current, session)) _sessionEpoch++;
     await Future.wait([
       for (final MapEntry(:key, :value) in encodeSessionFields(session).entries)
@@ -101,10 +136,12 @@ class SessionManager {
       ),
     ]);
     _current = session;
-    if (!_loaded.isCompleted) _loaded.complete();
   }
 
-  Future<void> signOut() async {
+  /// Wipes the active slots and forgets the active account. Other accounts
+  /// stay in their vaults; see [activate].
+  Future<AccountEntry?> signOut() async {
+    final removed = activeAccount;
     _sessionEpoch++;
     _loaded = Completer();
     _current = null;
@@ -112,14 +149,70 @@ class SessionManager {
       for (final field in _sessionFields) _secureStorage.delete(key: field),
       _writeGroupSecret(SessionKeys.appPassword, null),
       _writeGroupSecret(SessionKeys.appPasswordTalk, null),
+      if (removed != null) _secureStorage.delete(key: _vaultKey(removed.id)),
     ]);
+    if (removed != null) await _saveIndex(accounts.value.remove(removed.id));
+    return removed;
   }
 
-  static bool _isSameAccount(Session? a, Session? b) => switch ((a, b)) {
-    (final CredentialSession a, final CredentialSession b) =>
-      a.username == b.username && a.isDemo == b.isDemo,
-    _ => a == b,
-  };
+  /// Parks the active account (session, app passwords, MC token) in its vault
+  /// so the slots can be taken over by another account.
+  Future<void> stashActive() async {
+    final session = _current;
+    final entry = activeAccount;
+    if (session == null || entry == null) return;
+    final fields = {
+      ...sessionVaultFields(session),
+      ...await _tokenStorage.readAll(),
+    };
+    await _secureStorage.write(
+      key: _vaultKey(entry.id),
+      value: encodeVault(fields),
+    );
+  }
+
+  /// Loads the vault of [id] into the active slots. The active account must
+  /// have been stashed before, or its session is lost.
+  Future<void> activate(String id) async {
+    final fields = decodeVault(await _secureStorage.read(key: _vaultKey(id)));
+    final session = decodeSession(fields);
+    if (session == null) throw StateError('No stored session for account $id');
+    await _writeActive(session);
+    await _tokenStorage.writeAll(fields);
+    await _saveIndex(accounts.value.select(id, now: _now()));
+    if (!_loaded.isCompleted) _loaded.complete();
+  }
+
+  /// Remembers the real name of the active account for the account list.
+  Future<void> setDisplayName(String displayName) async {
+    final entry = activeAccount;
+    if (entry == null || entry.displayName == displayName) return;
+    await _saveIndex(accounts.value.rename(entry.id, displayName));
+  }
+
+  /// Session and MC token of an inactive account, e.g. to revoke them.
+  Future<(Session?, Map<String, String>)> readVault(String id) async {
+    final fields = decodeVault(await _secureStorage.read(key: _vaultKey(id)));
+    return (decodeSession(fields), fields);
+  }
+
+  /// Drops an inactive account without touching the active slots.
+  Future<void> forget(String id) async {
+    await _secureStorage.delete(key: _vaultKey(id));
+    await _saveIndex(accounts.value.remove(id));
+  }
+
+  static bool _isSameAccount(Session? a, Session? b) {
+    if (a == null || b == null) return a == b;
+    return identityOf(a) == identityOf(b) && a.isDemo == b.isDemo;
+  }
+
+  Future<void> _saveIndex(AccountIndex index) async {
+    accounts.value = index;
+    await _secureStorage.write(key: _indexKey, value: index.encode());
+  }
+
+  static int _now() => DateTime.now().millisecondsSinceEpoch;
 
   /// Persists a freshly minted Nextcloud app password; from then on every
   /// Nextcloud call authenticates with it instead of the real password.
@@ -202,6 +295,7 @@ class SessionManager {
     await _migrateFromLegacyStorage();
     await _migrateKeychainAccessibility();
     _current = await _readActive();
+    await _loadIndex();
     if (!_loaded.isCompleted) _loaded.complete();
   }
 
@@ -226,28 +320,60 @@ class SessionManager {
     return decodeSession(raw);
   }
 
-  /// Username currently in the keystore. Other engines (widget task, push
-  /// isolates) sign out or in without this instance noticing.
+  /// Username currently in the active slots. Other engines (widget task, push
+  /// isolates) sign out, in or switch without this instance noticing.
   Future<String?> readStoredUsername() =>
       _secureStorage.read(key: SessionKeys.username);
 
   /// Re-reads the session for long-lived background engines: they load once
-  /// and would otherwise keep acting with an account that signed out in the
-  /// app meanwhile. Keeps the known state when the keystore is unreadable.
+  /// and would otherwise keep acting with an account that signed out or was
+  /// switched away from in the app meanwhile. Keeps the known state when the
+  /// keystore is unreadable.
   Future<void> reloadFromStorage() async {
-    // The UI engine performs sign-in and sign-out itself, so its state is
-    // current; re-reading mid sign-out could resurrect the removed account.
+    // The UI engine performs sign-in, sign-out and switches itself, so its
+    // state is current; re-reading in between could resurrect the removed
+    // account.
     if (_isUiEngine) return;
     try {
       final session = await _readActive();
+      final index = AccountIndex.decode(
+        await _secureStorage.read(key: _indexKey),
+      );
       if (!_isSameAccount(_current, session)) _sessionEpoch++;
       _current = session;
+      accounts.value = index;
       if (!_loaded.isCompleted) _loaded.complete();
     } on Object catch (e) {
       log('Session reload failed, keeping loaded state: $e');
     }
   }
 
+  Future<void> _loadIndex() async {
+    var index = AccountIndex.decode(await _secureStorage.read(key: _indexKey));
+    final session = _current;
+    if (session != null) {
+      if (index.active == null ||
+          index.matching(session)?.id != index.activeId) {
+        // First start after the update: the existing account keeps its data
+        // in the un-namespaced storage.
+        index = index.activate(
+          session,
+          newId: randomHexId(bytes: 8),
+          namespace: index.accounts.isEmpty ? '' : null,
+          now: _now(),
+        );
+        await _secureStorage.write(key: _indexKey, value: index.encode());
+      }
+      accounts.value = index;
+      return;
+    }
+    accounts.value = index.remove(index.activeId ?? '');
+    // Interrupted switch or sign-out: fall back to another stored account
+    // instead of showing the login screen.
+    final fallback = accounts.value.mostRecentExcept(null);
+    if (fallback != null) await activate(fallback.id);
+  }
+
   // Move credentials from the old SharedPreferences plain-text storage into the
   // platform's secure keystore. Run once per install and clear the legacy keys.
   Future<void> _migrateFromLegacyStorage() async {