@ethora/chat-component-rn 26.6.12 → 26.7.1

package/src/helpers/resolveInitBeforeLoadUser.ts

@@ -1,12 +1,12 @@
-import http, { setBaseURL } from '../networking/apiClient';
+import { setBaseURL } from '../networking/apiClient';
+import { refreshAuthTokens, isRefreshFatalError } from '../networking/authRefresh';
 import { loginViaJwt } from '../networking/api-requests/auth.api';
 import { getMyUser } from '../networking/api-requests/user.api';
 import { IConfig, User } from '../types/types';
 import { store } from '../roomStore';
 import { setUser } from '../roomStore/chatSettingsSlice';
 import { walletToUsername } from './walletUsername';
-import { asyncLocalStorage } from '../hooks/useLocalStorage';
-import { localStorageConstants } from './constants/LOCAL_STORAGE';
+import { secureUserStorage } from './secureUserStorage';
 
 interface ResolveInitBeforeLoadUserOptions {
   config?: IConfig;
@@ -46,15 +46,107 @@ const normalizeUserForXmpp = (user?: User | null): User | null => {
   return { ...user, xmppUsername: normalizedXmppUsername };
 };
 
+// Hermes has no atob/Buffer; hand-decode just enough base64url to read a
+// JWT's `iat`. Claims are ASCII so the byte-per-char string is fine.
+const B64_ALPHABET =
+  'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+
+const readJwtIat = (token?: string | null): number => {
+  if (!token || typeof token !== 'string') {return 0;}
+  const part = token.split('.')[1];
+  if (!part) {return 0;}
+  try {
+    const clean = part.replace(/-/g, '+').replace(/_/g, '/');
+    let out = '';
+    let buffer = 0;
+    let bits = 0;
+    for (let i = 0; i < clean.length; i++) {
+      const idx = B64_ALPHABET.indexOf(clean[i]);
+      if (idx === -1) {continue;}
+      buffer = (buffer << 6) | idx;
+      bits += 6;
+      if (bits >= 8) {
+        bits -= 8;
+        out += String.fromCharCode((buffer >> bits) & 0xff);
+      }
+    }
+    const iat = JSON.parse(out)?.iat;
+    return typeof iat === 'number' ? iat : 0;
+  } catch {
+    return 0;
+  }
+};
+
+/**
+ * A `userLogin.user` is typically a snapshot the host captured at ITS
+ * login time and re-presents verbatim on every mount, while this SDK
+ * keeps rotating the session and persisting the newest pair to
+ * `ETHORA_USER`. Taking the snapshot as-is therefore discards the live
+ * session in favour of an ever-aging copy: media goes blank the moment
+ * the snapshot has no `fileToken` (secure-files URLs 401 without it),
+ * and once the snapshot's refresh token ages out entirely the account
+ * looks dead even though the SDK held a working session all along.
+ *
+ * So, for the SAME account only, prefer whichever refresh pair was
+ * minted later (JWT `iat` decides — a host that genuinely re-logged-in
+ * hands us newer tokens and wins), and fill in a missing `fileToken`
+ * from the persisted copy either way.
+ */
+const adoptFresherPersistedSession = async (candidate: User): Promise<User> => {
+  try {
+    const stored = await secureUserStorage().get();
+    if (!stored) {return candidate;}
+
+    const sameUser =
+      (candidate._id && stored._id && candidate._id === stored._id) ||
+      (candidate.xmppUsername &&
+        stored.xmppUsername &&
+        candidate.xmppUsername === stored.xmppUsername);
+    if (!sameUser) {return candidate;}
+
+    const merged = { ...candidate };
+
+    if (
+      stored.refreshToken &&
+      readJwtIat(stored.refreshToken) > readJwtIat(candidate.refreshToken)
+    ) {
+      merged.refreshToken = stored.refreshToken;
+      if (stored.token) {merged.token = stored.token;}
+      if (stored.fileToken) {merged.fileToken = stored.fileToken;}
+    }
+
+    if (!merged.fileToken && stored.fileToken) {
+      merged.fileToken = stored.fileToken;
+    }
+
+    return merged;
+  } catch {
+    return candidate;
+  }
+};
+
+/**
+ * Bootstrap rotation.
+ *
+ * Was a second, independent `/users/login/refresh` caller that bypassed
+ * every lock in the SDK — and, worse, only wrote the rotated token to
+ * the store on the happy path, so several of the early-return branches
+ * below used to drop it. Under the backend's reuse detection a dropped
+ * rotation means the next launch presents a burned token and the
+ * session is killed.
+ *
+ * `refreshAuthTokens` persists the new pair before it resolves, so by
+ * the time this returns the rotation is safe no matter which branch the
+ * caller takes afterwards. The explicit token is required here: during
+ * bootstrap the candidate session isn't in the store yet.
+ */
 const refreshWithToken = async (refreshToken: string) => {
-  const response = await http.post(
-    '/users/login/refresh',
-    {},
-    { headers: { Authorization: refreshToken } }
-  );
+  const result = await refreshAuthTokens({ refreshToken });
   return {
-    token: response?.data?.token || '',
-    refreshToken: response?.data?.refreshToken || refreshToken,
+    token: result.token,
+    refreshToken: result.refreshToken || refreshToken,
+    xmppPassword: result.xmppPassword || '',
+    fileToken: result.fileToken || '',
   };
 };
 
@@ -87,11 +179,15 @@ const tryHydrateViaMy = async (
 
   let workingToken = candidate?.token || '';
   let workingRefresh = candidate?.refreshToken || '';
+  let rotatedXmppPassword = '';
+  let workingFileToken = candidate?.fileToken || '';
 
   const candidateWithCurrentTokens = (): User => ({
     ...candidate,
     token: workingToken || candidate.token,
     refreshToken: workingRefresh || candidate.refreshToken,
+    xmppPassword: rotatedXmppPassword || candidate.xmppPassword,
+    fileToken: workingFileToken || candidate.fileToken,
   });
 
   const fallbackWithCreds = (): User | null => {
@@ -107,6 +203,8 @@ const tryHydrateViaMy = async (
       if (merged) {
         merged.token = workingToken || merged.token;
         merged.refreshToken = workingRefresh || merged.refreshToken;
+        merged.xmppPassword = rotatedXmppPassword || merged.xmppPassword;
+        merged.fileToken = workingFileToken || merged.fileToken;
       }
       return merged;
     } catch (error) {
@@ -127,6 +225,8 @@ const tryHydrateViaMy = async (
     const refreshed = await refreshWithToken(workingRefresh);
     workingToken = refreshed.token;
     workingRefresh = refreshed.refreshToken;
+    rotatedXmppPassword = refreshed.xmppPassword || rotatedXmppPassword;
+    workingFileToken = refreshed.fileToken || workingFileToken;
 
     try {
       const myUser = await getMyUser({ token: workingToken, endpoint: myEndpoint });
@@ -136,6 +236,8 @@ const tryHydrateViaMy = async (
       if (merged) {
         merged.token = workingToken || merged.token;
         merged.refreshToken = workingRefresh || merged.refreshToken;
+        merged.xmppPassword = rotatedXmppPassword || merged.xmppPassword;
+        merged.fileToken = workingFileToken || merged.fileToken;
       }
       return merged;
     } catch (myError) {
@@ -147,6 +249,11 @@ const tryHydrateViaMy = async (
     }
   } catch (error) {
     if (signal?.aborted || isAbortError(error)) {return null;}
+    // A fatal refresh verdict (reuse detected / token not found / stale
+    // with nothing newer around) carries no HTTP response, so it would
+    // otherwise fall through to `throw` — the session is simply dead,
+    // which for bootstrap means "nothing to restore".
+    if (isRefreshFatalError(error)) {return null;}
     if (isAuthError(error)) {return null;}
     throw error;
   }
@@ -162,13 +269,15 @@ export const resolveInitBeforeLoadUser = async (
     setBaseURL(config.baseUrl, config.customAppToken);
   }
 
-  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/users/my';
+  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/v1/users/my';
 
   // Priority 1: explicit userLogin
   const explicitUser = config?.userLogin?.enabled ? config?.userLogin?.user : null;
   if (explicitUser) {
     const candidate = normalizeUserForXmpp(explicitUser);
-    if (candidate && hasXmppCredentials(candidate)) {return candidate;}
+    if (candidate && hasXmppCredentials(candidate)) {
+      return await adoptFresherPersistedSession(candidate);
+    }
 
     const hydrated = await tryHydrateViaMy(explicitUser, myEndpoint, signal).catch(
       () => null
@@ -217,13 +326,13 @@ export const resolveInitBeforeLoadUser = async (
 
   // Priority 5: persisted user in AsyncStorage
   try {
-    const storedUser = await asyncLocalStorage<User>(localStorageConstants.ETHORA_USER).get();
+    const storedUser = await secureUserStorage().get();
     if (storedUser && (storedUser.token || storedUser.refreshToken || storedUser.xmppPassword)) {
       const hydrated = await tryHydrateViaMy(storedUser, myEndpoint, signal).catch(
         () => null
       );
       if (hydrated && hasXmppCredentials(hydrated)) {return hydrated;}
-      await asyncLocalStorage(localStorageConstants.ETHORA_USER).remove();
+      await secureUserStorage().remove();
     }
   } catch {
     // ignore storage errors
@@ -275,7 +384,7 @@ export const refreshUserCredentialsForXmpp = async (
     }
   }
 
-  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/users/my';
+  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/v1/users/my';
 
   // Priority 2: redux store user (covers userLogin + customLogin +
   // anything previously persisted into chatSettingStore.user). The
@@ -295,9 +404,7 @@ export const refreshUserCredentialsForXmpp = async (
   // should already mirror this, but if the redux state got cleared
   // mid-session (logout race) this gives us one last shot.
   try {
-    const storedUser = await asyncLocalStorage<User>(
-      localStorageConstants.ETHORA_USER
-    ).get();
+    const storedUser = await secureUserStorage().get();
     if (
       storedUser &&
       (storedUser.token || storedUser.refreshToken || storedUser.xmppPassword)

package/src/helpers/secureFileUrl.ts

@@ -0,0 +1,103 @@
+import { store } from '../roomStore';
+import { getCurrentBaseURL } from '../networking/apiClient';
+import { refreshAuthTokens } from '../networking/authRefresh';
+
+const SECURE_FILES_HOST_PREFIX = 'secure-files.';
+const SECURE_MEDIA_PATH_PREFIX = '/secure-media/';
+
+const FILE_TOKEN_PARAM = 'ft';
+
+export const resolveFileUrl = (url?: string | null): string => {
+  if (!url) {return '';}
+  // Any scheme at all — http(s), data, file, content, blob.
+  if (/^[a-z][a-z0-9+.-]*:/i.test(url)) {return url;}
+  if (!url.startsWith('/')) {return url;}
+
+  const base = getCurrentBaseURL().replace(/\/+$/, '');
+  return base ? `${base}${url}` : url;
+};
+
+export const isSecureFileUrl = (url?: string | null): boolean => {
+  if (!url) {return false;}
+
+  const path = url.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, '');
+  if (path.startsWith(SECURE_MEDIA_PATH_PREFIX)) {return true;}
+
+  const match = /^https?:\/\/(?:[^@/]+@)?([^:/?#]+)/i.exec(url);
+  if (!match) {return false;}
+  return match[1].toLowerCase().startsWith(SECURE_FILES_HOST_PREFIX);
+};
+
+export const appendFileToken = (
+  url: string | null | undefined,
+  fileToken: string | null | undefined
+): string => {
+  if (!url) {return '';}
+
+  const resolved = resolveFileUrl(url);
+  if (!fileToken || !isSecureFileUrl(resolved)) {return resolved;}
+  url = resolved;
+
+  const hashIndex = url.indexOf('#');
+  const hash = hashIndex === -1 ? '' : url.slice(hashIndex);
+  const withoutHash = hashIndex === -1 ? url : url.slice(0, hashIndex);
+
+  const queryIndex = withoutHash.indexOf('?');
+  const base = queryIndex === -1 ? withoutHash : withoutHash.slice(0, queryIndex);
+  const query = queryIndex === -1 ? '' : withoutHash.slice(queryIndex + 1);
+
+  const params = query
+    .split('&')
+    .filter(Boolean)
+    .filter((pair) => pair.split('=')[0] !== FILE_TOKEN_PARAM);
+
+  params.push(`${FILE_TOKEN_PARAM}=${encodeURIComponent(fileToken)}`);
+
+  return `${base}?${params.join('&')}${hash}`;
+};
+
+export const withFileToken = (url?: string | null): string =>
+  appendFileToken(
+    url,
+    store.getState().chatSettingStore?.user?.fileToken || ''
+  );
+
+const RECOVERY_COOLDOWN_MS = 30_000;
+let recoveryInFlight: Promise<boolean> | null = null;
+let lastRecoveryAt = 0;
+
+export const requestFileTokenRecovery = (): Promise<boolean> => {
+  if (recoveryInFlight) {return recoveryInFlight;}
+
+  const now = Date.now();
+  if (now - lastRecoveryAt < RECOVERY_COOLDOWN_MS) {
+    return Promise.resolve(false);
+  }
+  lastRecoveryAt = now;
+
+  const state = store.getState();
+  const refreshConfig = state.chatSettingStore?.config?.refreshTokens;
+  const user = state.chatSettingStore?.user;
+
+  if (!refreshConfig?.enabled) {return Promise.resolve(false);}
+
+  const run = async (): Promise<boolean> => {
+    if (!refreshConfig.refreshFunction && !user?.refreshToken) {return false;}
+
+    const tokens = await refreshAuthTokens();
+    return Boolean(tokens.fileToken);
+  };
+
+  recoveryInFlight = run()
+    .catch(() => false)
+    .finally(() => {
+      recoveryInFlight = null;
+    });
+
+  return recoveryInFlight;
+};
+
+export const __resetFileTokenRecoveryForTests = (): void => {
+  recoveryInFlight = null;
+  lastRecoveryAt = 0;
+};

package/src/helpers/secureKeyValue.ts

@@ -0,0 +1,80 @@
+import AsyncStorage from '@react-native-async-storage/async-storage';
+import { loadSecureStore } from './secureStoreRuntime';
+import { pushLog } from '../utils/devLogger';
+
+// Fallback keys are prefixed and namespaced away from every other
+// AsyncStorage key this SDK writes, so a host that never installs
+// expo-secure-store can still be told apart from one that used to lack
+// it and has since added it (see `secureSet`'s stale-fallback cleanup).
+const FALLBACK_PREFIX = '@ethora/secure-fallback:';
+
+let warnedFallback = false;
+const warnFallbackOnce = () => {
+  if (warnedFallback) {return;}
+  warnedFallback = true;
+  pushLog(
+    'warn',
+    'expo-secure-store is not installed — auth tokens, the XMPP ' +
+      'password, and the message-history cipher key are falling back ' +
+      'to plain AsyncStorage instead of the platform Keychain/Keystore. ' +
+      'Add the optional peer dependency `expo-secure-store` to your app ' +
+      'to store them securely.'
+  );
+};
+
+/**
+ * Small-value secure KV store: platform Keychain/Keystore via
+ * expo-secure-store when the host has it installed, plain (but still
+ * namespaced) AsyncStorage otherwise. NOT for bulk data — see
+ * `persistCrypto.ts`'s size note on why message history goes through
+ * AES instead of straight into this store.
+ */
+export async function secureGet(key: string): Promise<string | null> {
+  const store = loadSecureStore();
+  if (store) {
+    try {
+      return await store.getItemAsync(key);
+    } catch (e) {
+      pushLog('warn', `secureStore: getItemAsync(${key}) failed`, e);
+      return null;
+    }
+  }
+  warnFallbackOnce();
+  return AsyncStorage.getItem(FALLBACK_PREFIX + key);
+}
+
+export async function secureSet(key: string, value: string): Promise<void> {
+  const store = loadSecureStore();
+  if (store) {
+    try {
+      await store.setItemAsync(key, value);
+      // Clean up a stale plaintext fallback copy from before this host
+      // added expo-secure-store — otherwise it sits on disk forever.
+      AsyncStorage.removeItem(FALLBACK_PREFIX + key).catch(() => undefined);
+      return;
+    } catch (e) {
+      pushLog('warn', `secureStore: setItemAsync(${key}) failed`, e);
+      return;
+    }
+  }
+  warnFallbackOnce();
+  await AsyncStorage.setItem(FALLBACK_PREFIX + key, value);
+}
+
+export async function secureRemove(key: string): Promise<void> {
+  const store = loadSecureStore();
+  if (store) {
+    try {
+      await store.deleteItemAsync(key);
+    } catch {
+      // Key may simply not exist — deleteItemAsync throwing here isn't
+      // actionable either way.
+    }
+  }
+  await AsyncStorage.removeItem(FALLBACK_PREFIX + key).catch(() => undefined);
+}
+
+/** Test seam only. */
+export const __resetSecureKeyValueWarningForTests = (): void => {
+  warnedFallback = false;
+};

package/src/helpers/secureStoreRuntime.ts

@@ -0,0 +1,62 @@
+/**
+ * Optional-dependency bridge for `expo-secure-store` — the Keychain
+ * (iOS) / Keystore-backed EncryptedSharedPreferences (Android) API.
+ *
+ * Mirrors `components/VideoCalls/livekitRuntime.ts`: a plain top-level
+ * `import ... from 'expo-secure-store'` is not allowed anywhere in the
+ * SDK, since Metro resolves imports at bundle time and a host that
+ * hasn't added this optional peer dependency would fail to build over
+ * a feature it never opted into. Everything goes through
+ * `loadSecureStore()`, which requires the module lazily and returns
+ * null when it isn't installed — callers fall back to plain
+ * AsyncStorage rather than crash (see `secureKeyValue.ts`).
+ */
+
+export interface SecureStoreRuntime {
+  getItemAsync: (key: string) => Promise<string | null>;
+  setItemAsync: (key: string, value: string) => Promise<void>;
+  deleteItemAsync: (key: string) => Promise<void>;
+}
+
+let cached: SecureStoreRuntime | null | undefined;
+
+/**
+ * Resolve the SecureStore runtime, or null when the optional native
+ * package isn't installed in the host app. Result is memoised
+ * (including the failure) so a missing dependency doesn't re-throw on
+ * every read/write.
+ */
+export const loadSecureStore = (): SecureStoreRuntime | null => {
+  if (cached !== undefined) {
+    return cached;
+  }
+
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const mod = require('expo-secure-store');
+    if (
+      typeof mod?.getItemAsync !== 'function' ||
+      typeof mod?.setItemAsync !== 'function' ||
+      typeof mod?.deleteItemAsync !== 'function'
+    ) {
+      cached = null;
+    } else {
+      cached = {
+        getItemAsync: mod.getItemAsync,
+        setItemAsync: mod.setItemAsync,
+        deleteItemAsync: mod.deleteItemAsync,
+      };
+    }
+  } catch {
+    cached = null;
+  }
+
+  return cached;
+};
+
+export const isSecureStoreAvailable = (): boolean => loadSecureStore() !== null;
+
+/** Test seam only. */
+export const __resetSecureStoreRuntimeForTests = (): void => {
+  cached = undefined;
+};

package/src/helpers/secureUserStorage.ts

@@ -0,0 +1,80 @@
+import { User } from '../types/types';
+import { asyncLocalStorage } from '../hooks/useLocalStorage';
+import { localStorageConstants } from './constants/LOCAL_STORAGE';
+import { secureGet, secureSet, secureRemove } from './secureKeyValue';
+
+// Keychain (iOS) / Keystore-backed EncryptedSharedPreferences (Android)
+// keys for the four live bearer credentials on `User`. Deliberately one
+// key per field rather than one JSON blob: expo-secure-store historically
+// caps a single value's size on Android, and four short JWTs each stay
+// comfortably under that ceiling where one combined blob might not.
+const SECRET_KEYS = {
+  token: 'ethora_auth_token',
+  refreshToken: 'ethora_auth_refresh_token',
+  xmppPassword: 'ethora_auth_xmpp_password',
+  fileToken: 'ethora_auth_file_token',
+} as const;
+
+type SecretField = keyof typeof SECRET_KEYS;
+const SECRET_FIELDS = Object.keys(SECRET_KEYS) as SecretField[];
+
+/**
+ * Persisted-user storage, split across two backends behind the exact
+ * same `{ get, set, remove }` shape `asyncLocalStorage<User>(...)`
+ * already exposed — every existing call site swaps in by changing only
+ * the constructor call, `get()`/`set()`/`remove()` keep returning/taking
+ * a complete `User`.
+ *
+ * The four live credentials (REST access + refresh token, XMPP
+ * password, secure-media fileToken) never touch plain AsyncStorage:
+ * they go through `secureGet`/`secureSet`/`secureRemove` (platform
+ * Keychain/Keystore, falling back to namespaced AsyncStorage only when
+ * the host hasn't installed the optional `expo-secure-store` peer dep).
+ * Everything else on `User` — name, avatar, ids, xmppUsername, wallet
+ * address, none of it a bearer credential — keeps living under the
+ * existing `ETHORA_USER` AsyncStorage key, unchanged.
+ */
+export function secureUserStorage() {
+  const get = async (): Promise<User | null> => {
+    const profile = await asyncLocalStorage<User>(
+      localStorageConstants.ETHORA_USER
+    ).get();
+    if (!profile) {return null;}
+
+    const secretValues = await Promise.all(
+      SECRET_FIELDS.map((field) => secureGet(SECRET_KEYS[field]))
+    );
+
+    const merged: User = { ...profile };
+    SECRET_FIELDS.forEach((field, i) => {
+      (merged as any)[field] = secretValues[i] || '';
+    });
+    return merged;
+  };
+
+  const set = async (user: User): Promise<void> => {
+    const profile: any = { ...user };
+    for (const field of SECRET_FIELDS) {
+      profile[field] = '';
+    }
+
+    await Promise.all([
+      asyncLocalStorage<User>(localStorageConstants.ETHORA_USER).set(profile),
+      ...SECRET_FIELDS.map((field) => {
+        const value = user?.[field] as string | undefined;
+        return value
+          ? secureSet(SECRET_KEYS[field], value)
+          : secureRemove(SECRET_KEYS[field]);
+      }),
+    ]);
+  };
+
+  const remove = async (): Promise<void> => {
+    await Promise.all([
+      asyncLocalStorage(localStorageConstants.ETHORA_USER).remove(),
+      ...SECRET_FIELDS.map((field) => secureRemove(SECRET_KEYS[field])),
+    ]);
+  };
+
+  return { get, set, remove };
+}

package/src/hooks/useChatWrapperInit.ts

@@ -10,7 +10,7 @@ import { chatAutoEnterer } from '../helpers/chatAutoEnterer';
 import { initRoomsPresence } from '../helpers/initRoomsPresence';
 import { updatedChatLastTimestamps } from '../helpers/updatedChatLastTimestamps';
 import { updateMessagesTillLast } from '../helpers/updateMessagesTillLast';
-import { refresh } from '../networking/apiClient';
+import { refreshAuthTokensQuietly } from '../networking/authRefresh';
 import { setLangSource, setConfig } from '../roomStore/chatSettingsSlice';
 import { setIsLoading } from '../roomStore/roomsSlice';
 import { useRoomState } from './useRoomState';
@@ -179,7 +179,7 @@ const useChatWrapperInit = ({
               }
 
               {
-                config?.refreshTokens?.enabled && refresh();
+                config?.refreshTokens?.enabled && refreshAuthTokensQuietly();
               }
             } catch (error) {
               console.error(' Error during initialization', error);
@@ -233,7 +233,7 @@ const useChatWrapperInit = ({
               setConnectionLost(false);
             }
             {
-              config?.refreshTokens?.enabled && refresh();
+              config?.refreshTokens?.enabled && refreshAuthTokensQuietly();
             }
           }
         }

package/src/hooks/useFileToken.ts

@@ -0,0 +1,7 @@
+import { useSelector } from 'react-redux';
+import { RootState } from '../roomStore';
+
+export const useFileToken = (): string =>
+  useSelector(
+    (state: RootState) => state.chatSettingStore.user?.fileToken || ''
+  );

package/src/hooks/useLogout.tsx

@@ -9,7 +9,7 @@ import { clearHeap } from '../roomStore/roomHeapSlice';
 import { pushSubscriptionService } from '../services/pushSubscriptionService';
 import { clearRoomsRestCache } from '../networking/api-requests/rooms.api';
 import { clearPersistedState } from '../roomStore/persistence';
-import { localStorageConstants } from '../helpers/constants/LOCAL_STORAGE';
+import { secureUserStorage } from '../helpers/secureUserStorage';
 
 // AsyncStorage keys the library writes but that aren't cleared by any
 // slice reducer. Listed here so a single logout call wipes the full
@@ -120,17 +120,23 @@ const logoutService = {
 
     // 6. Stray keys the slices don't touch.
     try {
-      await AsyncStorage.multiRemove([
-        ...LIBRARY_STRAY_KEYS,
-        // Belt-and-suspenders: the chat slice's `logout` reducer
-        // schedules an async remove of ETHORA_USER fire-and-forget;
-        // re-issue it here so the disk is provably clean before this
-        // Promise resolves.
-        localStorageConstants.ETHORA_USER,
-      ]);
+      await AsyncStorage.multiRemove(LIBRARY_STRAY_KEYS);
     } catch (e) {
       console.warn('logoutService: stray-key clear failed', e);
     }
+
+    // 7. Belt-and-suspenders: the chat slice's `logout` reducer already
+    //    fires an async ETHORA_USER removal, but re-issue it here (via
+    //    the same secureUserStorage split the reducer uses) so BOTH the
+    //    plain-AsyncStorage profile half AND the Keychain/Keystore
+    //    secrets are provably gone before this Promise resolves — a bare
+    //    `AsyncStorage.removeItem(ETHORA_USER)` here would only clear the
+    //    profile half and leave the tokens behind.
+    try {
+      await secureUserStorage().remove();
+    } catch (e) {
+      console.warn('logoutService: secure user storage clear failed', e);
+    }
   },
 };