[Wasabules]

The bug

Unlocking decrypts the database into the file SQLite works on, and deletes the encrypted file. Closing encrypts it again.

A session that stops in between (a crash, a forced stop, a power cut) leaves only the clear file. At the next start:

• no encrypted file is found, so the database is opened as if encryption were off, without asking for the password;
• closing has no password to encrypt with, so the database stays in the clear from then on.

Encryption is still shown as on all that time. It happened on a real installation today: a dev session was killed while its database was unlocked.

The fix

• Detection: a database that encryption is on for, found in the clear, now waits for the password like an encrypted one (LogStore.leftClear).
• Checking the password: it is checked as usual, against the keyring. An installation older than the keyring has no encrypted database left to fail on, and a mistyped password would encrypt everything under it. So in that case the password is checked against the other files it encrypts (readableWith).
• Then: the database opens as it is, with nothing lost, and closing encrypts it again. The recovery key opens it too.
• The unlock screen says what happened: IsDatabaseLeftClear, on Backend, and on the window's own store when it drives a sealing service. The message is in the 8 locales, and the user guide's Encryption section explains it.

Tests

internal/engine/leftclear_test.go reproduces it:

1. An encrypted database is unlocked, and its files are copied while the session runs, which is what a killed process leaves.
2. The copy is started: it is locked and reported as left in the clear.
3. A wrong password is refused; the right one opens every message.
4. Closing leaves only the encrypted file, which opens at the next start like any encrypted database.

Another test checks that a database never encrypted still opens without a password. The cross-version fixtures (v1.6.1, v1.7.1, vault v1) still pass.

Checked: go vet (Windows, Linux), staticcheck, go test -race ./..., svelte-check --fail-on-warnings, npm test, npm run build.