feat: SQLCipher-encrypted local database migration (expo-sqlite + Drizzle)#7421
Draft
diegolmello wants to merge 14 commits into
Draft
feat: SQLCipher-encrypted local database migration (expo-sqlite + Drizzle)#7421diegolmello wants to merge 14 commits into
diegolmello wants to merge 14 commits into
Conversation
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
diegolmello
had a problem deploying
to
android_build
GitHub Actions
Error
…r-server databases (#7395)
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
diegolmello
had a problem deploying
to
android_build
GitHub Actions
Error
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
diegolmello
had a problem deploying
to
android_build
GitHub Actions
Error
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
…qlcipher-migration
getLocalAnchor and its test imported Q directly from @nozbe/watermelondb, which the facade lint rule bans app-wide. Point both at app/lib/database/facade; the facade re-exports Q, so the query and assertions are unchanged. Claude-Session: https://claude.ai/code/session_01TE9VsFTeXsXc8ssqeR8MJ7
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
The merged develop test inspected WatermelonDB's clause internals (left, comparison.right.value), but useMessages builds queries with the facade's Q, whose where clause exposes column and comparison.value. Read the facade shape so the upper-bound ts assertions match the engine in use. Claude-Session: https://claude.ai/code/session_01TE9VsFTeXsXc8ssqeR8MJ7
diegolmello
temporarily deployed
to
approve_e2e_testing
GitHub Actions
Inactive
diegolmello
temporarily deployed
to
android_build
GitHub Actions
Inactive
|
iOS Build Available Rocket.Chat 4.74.0.109185 |
…qlcipher-migration # Conflicts: # app/sagas/messages.js
diegolmello
had a problem deploying
to
approve_e2e_testing
GitHub Actions
Error
diegolmello
had a problem deploying
to
android_build
GitHub Actions
Error
A develop merge duplicated both the import and the add() call in the package list. Kotlin rejects the repeated import as ambiguous, breaking compileDebugKotlin. Claude-Session: https://claude.ai/code/session_01R71aVJWSdFAv7R3FjD1VnJ
The facade's Collection.create / Model.update wrap their work in db.write(), and call sites wrap again (the WMDB db.write(() => collection.create()) idiom). The WriterQueue was non-reentrant, so a nested write deadlocked: the outer writer awaited the inner, which was queued behind it and could never run. At first boot this hung NewServerView's Connect on the very first server upsert. Make the queue run a nested enqueue inline within the active writer. With the deadlock gone the next defect surfaced: a freshly opened encrypted database had no tables (no such table: servers). The migrate() call that applies the Drizzle DDL bundles was dropped from openDb in a develop merge. Restore it; the migrator creates tables on first open and is a no-op after. Claude-Session: https://claude.ai/code/session_01R71aVJWSdFAv7R3FjD1VnJ
diegolmello
temporarily deployed
to
approve_e2e_testing
GitHub Actions
Inactive
diegolmello
temporarily deployed
to
android_build
GitHub Actions
Inactive
diegolmello
had a problem deploying
to
upload_android
GitHub Actions
Error
|
Android Build Available Rocket.Chat 4.74.0.109190 Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNS9z7VdD7TAcAWwfo7Lo4YibOXVU_AFFSy_gcy-98I1WZXpkIrQfoEOc92EzZvxbpV5f94zH_2atPvVOEKl |
|
iOS Build Available Rocket.Chat 4.74.0.109191 |
On a deep-link or call-push cold start, app/index.tsx dispatches the deep-link action and returns BEFORE appInit(), so restore() never runs and database.initServers() never opens the encrypted servers DB. The handlers then read database.servers, whose getter throws "Servers database accessed before initServers() resolved", killing the saga task before login can complete — so rooms-list-view never appears and every deep-link-login E2E shard fails its visibility assertion. This regressed when the synchronous WatermelonDB database.servers became an async-initialised facade: warm launches still work because restore() opens the DB first, but the cold-start deep-link/push paths bypass appInit() entirely. Fix: call the idempotent database.initServers at the top of handleOpen and handleClickCallPush, before any servers-DB read. No-op on a warm launch where restore() already opened it. Verified on-device: an auth deep-link into a freshly-cleared app now reaches the rooms list. Claude-Session: https://claude.ai/code/session_01R71aVJWSdFAv7R3FjD1VnJ
diegolmello
temporarily deployed
to
approve_e2e_testing
GitHub Actions
Inactive
diegolmello
temporarily deployed
to
android_build
GitHub Actions
Inactive
diegolmello
had a problem deploying
to
upload_android
GitHub Actions
Error
|
Android Build Available Rocket.Chat 4.74.0.109192 Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNQiZsjKsMsVx_L55MQrWrBixv-QdqScdkMiRi9Kd8WeXuQ914UeBLVolc32U65HyRzbwxcb1OLqLL38ODYH |
|
iOS Build Available Rocket.Chat 4.74.0.109193 |
diegolmello
commented
Jun 24, 2026
| edgeToEdgeEnabled=false | ||
|
|
||
| # Enable SQLCipher via expo-sqlite (required for encrypted-at-rest databases) | ||
| expo.sqlite.useSQLCipher=true No newline at end of file |
Member
Author
There was a problem hiding this comment.
Need to be added to CI gradle.properties change.
diegolmello
requested a deployment
to
approve_e2e_testing
GitHub Actions
Waiting
diegolmello
requested a deployment
to
android_build
GitHub Actions
Waiting
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Long-lived integration branch for replacing WatermelonDB with expo-sqlite + Drizzle ORM, with every local database SQLCipher-encrypted from byte zero. Goal: offline forensic extraction of a powered-down or backed-up device yields no chat content or auth tokens.
Each sub-task lands here as its own PR (so each gets full native iOS/Android CI); this branch merges to develop only once the facade cutover is ready. The Drizzle schema, the driver adapter, the native key store, and the encrypted native readers are all additive and inert — nothing reads them until the cutover flips the database singleton from WatermelonDB to Drizzle and enables SQLCipher, so each piece can merge and revert independently.
Landed so far:
Issue(s)
NATIVE-1272 — https://rocketchat.atlassian.net/browse/NATIVE-1272
How to test or reproduce
Nothing is wired into the running app yet — the key store is additive and inert until the cutover, so there is no user-visible change to exercise. Verify the merged sub-task in isolation:
TZ=UTC pnpm test --testPathPattern='keyStore'— JS wrapper contract (mint, fail-closed read, malformed-key rejection).pnpm lint— eslint + tsc.Native key-store behavior (durable write, write-once, Keychain/Keystore) has no JS-reachable harness; it is exercised by the iOS and Android builds on CI.
Types of changes
Checklist
Further comments
Subsequent sub-tasks — driver adapter + key service, Drizzle schema, native reader rewrite, facade cutover, wipe-and-restore migration, performance parity gates, hardening, and rollout — target this branch as separate PRs. Delivery sequencing and dependency order are tracked on NATIVE-1272.