doctate/clients/desktop/src/startup.rs

//! One-shot client startup routines shared across all native clients.
//!
//! Today this is just the data-minimization sweep: ephemeral devices
//! (desktop, watch, phone) are "sophisticated microphones" — the client
//! must not hoard patient-sensitive audio or metadata past the
//! dictation-day horizon.
//!
//! Two retention horizons exist:
//! - **Audio** (sensitive): 24 h by default. Orphan m4a/sidecar files
//!   that never reached the server get deleted.
//! - **Markers** (non-sensitive: UUIDs + oneliners): 72 h by default.
//!   Long enough to span a weekend; short enough that a stolen device
//!   can't reconstruct a long case history.

use std::path::Path;
use std::time::{Duration, SystemTime};

use time::OffsetDateTime;
use tracing::{info, warn};

use crate::case_store::CaseStore;
use crate::pending_cleanup::cleanup_orphan_audio;

/// Default retention for case-markers on disk. Confirmed-by-server
/// markers older than this are pruned; unsynced markers are kept
/// forever (they guard pending uploads).
pub const DEFAULT_MARKER_RETENTION: Duration = Duration::from_secs(72 * 3600);

/// Default retention for orphan audio files in the pending directory.
/// Orphan = an `.m4a` without its matching sidecar, or vice versa,
/// older than this horizon.
pub const DEFAULT_ORPHAN_AUDIO_RETENTION: Duration = Duration::from_secs(24 * 3600);

/// Run the one-shot startup cleanup. Intended to be called once at app
/// launch, before the server-sync worker spawns.
///
/// Logs each outcome via `tracing`; no error bubbles up because both
/// sweeps are best-effort (a failing sweep shouldn't prevent the app
/// from starting).
pub async fn run_startup_cleanup(
    store: &CaseStore,
    pending_dir: &Path,
    marker_retention: Duration,
    orphan_audio_retention: Duration,
) {
    let marker_cutoff =
        OffsetDateTime::now_utc() - time::Duration::seconds(marker_retention.as_secs() as i64);
    match store.cleanup_stale(marker_cutoff).await {
        Ok(n) if n > 0 => info!(count = n, "startup cleanup: stale markers removed"),
        Ok(_) => {}
        Err(e) => warn!(error = %e, "startup cleanup: marker sweep failed"),
    }

    let audio_cutoff = SystemTime::now() - orphan_audio_retention;
    let n = cleanup_orphan_audio(pending_dir, audio_cutoff).await;
    if n > 0 {
        info!(count = n, "startup cleanup: orphan audio removed");
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::upload::{PendingUpload, write_sidecar};
    use filetime::{FileTime, set_file_mtime};
    use tempfile::TempDir;
    use uuid::Uuid;

    /// Integration-style test: seed a stale synced marker + an orphan
    /// audio file, call the helper with tight retention horizons, watch
    /// both go away.
    #[tokio::test]
    async fn sweeps_both_stale_markers_and_orphan_audio() {
        let tmp = TempDir::new().unwrap();
        let cases_dir = tmp.path().join("cases");
        let pending_dir = tmp.path().join("pending");
        std::fs::create_dir_all(&pending_dir).unwrap();

        // Seed a stale synced marker by opening the store, creating it,
        // flipping the synced flag via merge, then reopening to re-scan.
        {
            let (store, _rx) = CaseStore::open(cases_dir.clone()).await.unwrap();
            let old_id = Uuid::new_v4();
            let then = OffsetDateTime::parse(
                "2020-01-01T00:00:00Z",
                &time::format_description::well_known::Rfc3339,
            )
            .unwrap();
            store.create_local(old_id, then).await.unwrap();
            store.mark_synced(old_id).await.unwrap();
        }

        // Seed an orphan audio file, pre-dated to be older than 24h.
        let orphan = pending_dir.join("orphan.m4a");
        std::fs::write(&orphan, b"dummy").unwrap();
        let two_days_ago = SystemTime::now() - Duration::from_secs(48 * 3600);
        set_file_mtime(&orphan, FileTime::from_system_time(two_days_ago)).unwrap();

        // Also seed a fresh, *paired* upload — must survive both sweeps.
        let fresh_id = Uuid::new_v4();
        let fresh_stem = format!("{fresh_id}_2026-04-18T10-00-00Z");
        let fresh_m4a = pending_dir.join(format!("{fresh_stem}.m4a"));
        let upload = PendingUpload {
            case_id: fresh_id,
            recorded_at: "2026-04-18T10:00:00Z".into(),
            file: fresh_m4a.clone(),
        };
        std::fs::write(&fresh_m4a, b"fresh audio").unwrap();
        write_sidecar(&upload).unwrap();

        // Reopen store to load all on-disk markers.
        let (store, _rx) = CaseStore::open(cases_dir).await.unwrap();

        run_startup_cleanup(
            &store,
            &pending_dir,
            Duration::from_secs(3600), // markers older than 1h: nuke
            Duration::from_secs(3600), // orphans older than 1h: nuke
        )
        .await;

        // Stale marker gone.
        assert!(
            store.list().await.is_empty(),
            "old synced marker must be swept"
        );
        // Orphan gone.
        assert!(!orphan.exists(), "old orphan audio must be swept");
        // Fresh paired upload survived.
        assert!(fresh_m4a.exists(), "fresh paired m4a must remain");
    }

    #[tokio::test]
    async fn no_op_on_clean_directories() {
        let tmp = TempDir::new().unwrap();
        let cases_dir = tmp.path().join("cases");
        let pending_dir = tmp.path().join("pending");
        std::fs::create_dir_all(&pending_dir).unwrap();
        let (store, _rx) = CaseStore::open(cases_dir).await.unwrap();

        // Should simply return without error and without logs at >= warn.
        run_startup_cleanup(
            &store,
            &pending_dir,
            DEFAULT_MARKER_RETENTION,
            DEFAULT_ORPHAN_AUDIO_RETENTION,
        )
        .await;
    }
}