(function(){ var W = window; // Idempotent: a second copy must never wrap the first shim. if ("__WIZZAD_STORAGE_OWNER__" in W) return; var OWNER = null; // Set unconditionally before returning, on EVERY path including a throw. // If it were left unset, a signed-in page would report "no partition // installed" and AuthProvider's staleness check would reload forever. try { var DEVICE = ["wizzad:storage:owner","wizzad:storage:legacy-owner","wizzad:storage:seen","wizzad:auth:changed","lms_extension_inbox","lms_extension_last_import"]; var PPFX = "wz:u:"; var ANON = "@anon"; var K_OWNER = "wizzad:storage:owner", K_LEGACY = "wizzad:storage:legacy-owner", K_INDEX = "wizzad:storage:seen"; var ownerKey = OWNER || ANON; // Capture the real storages BEFORE anything is replaced. var rawLocal = null, rawSession = null; try { rawLocal = W.localStorage; } catch (e) {} try { rawSession = W.sessionStorage; } catch (e) {} function isDevice(k) { return DEVICE.indexOf(k) !== -1; } function startsWith(s, p) { return s.lastIndexOf(p, 0) === 0; } // ── Resolve this document's partition ──────────────────────────────── // The first account ever seen on this browser adopts the pre-existing // unprefixed data and keeps using it (IndexedDB cannot be renamed, so a // real migration would mean copying 17 databases). Everyone after that // gets a namespace of their own. var legacy = null; if (rawLocal) { try { legacy = rawLocal.getItem(K_LEGACY); } catch (e) {} } if (OWNER && legacy === null && rawLocal) { legacy = OWNER; try { rawLocal.setItem(K_LEGACY, OWNER); } catch (e) {} } var prefix = (OWNER && OWNER === legacy) ? "" : PPFX + ownerKey + ":"; // Does a raw key / database name belong to THIS partition? For a prefixed // partition that is a simple prefix test. For the legacy partition (empty // prefix) it means "anything that is not some other account's namespace" — // a plain `startsWith(name, "")` would match every account's entries. function ownsName(name) { return prefix === "" ? !startsWith(name, PPFX) : startsWith(name, prefix); } function stripPrefix(name) { return prefix === "" ? name : name.slice(prefix.length); } // ── Quota: evict the least-recently-used OTHER partition ───────────── // localStorage is a single ~5MB budget for the whole origin, now shared // between accounts. Without this, one account filling it would make // every other account's writes throw. function touchPartition() { if (!rawLocal) return; try { var idx = JSON.parse(rawLocal.getItem(K_INDEX) || "{}"); idx[ownerKey] = Date.now(); rawLocal.setItem(K_INDEX, JSON.stringify(idx)); } catch (e) {} } function evictLruPartition() { if (!rawLocal) return false; try { var idx = JSON.parse(rawLocal.getItem(K_INDEX) || "{}"); var victim = null, oldest = Infinity, k; for (k in idx) { // Never evict ourselves, and never the legacy partition — it has no // prefix, so "its keys" cannot be identified by a prefix scan. if (k === ownerKey || k === legacy) continue; if (idx[k] < oldest) { oldest = idx[k]; victim = k; } } if (victim === null) return false; var vp = PPFX + victim + ":", doomed = [], i, key; for (i = 0; i < rawLocal.length; i++) { key = rawLocal.key(i); if (key !== null && startsWith(key, vp)) doomed.push(key); } for (i = 0; i < doomed.length; i++) { try { rawLocal.removeItem(doomed[i]); } catch (e) {} } delete idx[victim]; rawLocal.setItem(K_INDEX, JSON.stringify(idx)); return doomed.length > 0; } catch (e) { return false; } } // ── The Storage substitute ─────────────────────────────────────────── function scope(raw) { if (!raw) return raw; function toRaw(k) { return isDevice(k) ? k : prefix + k; } // Device keys are excluded from enumeration so that a feature calling // clear() cannot wipe the markers partitioning itself depends on. function owns(rawKey) { return !isDevice(rawKey) && ownsName(rawKey); } // Memoised because `length` and `key(i)` each need the full list, and the // idiomatic `for (i = 0; i < localStorage.length; i++) localStorage.key(i)` // would otherwise rebuild it on every iteration — O(n²). Two real call // sites do exactly that (`lib/cowork/pulse-signals.ts`, which BrainPulse // runs from the global layout, and `components/video-chat/lib/dailyReview.ts`); // measured at 500 keys that walk cost ~60ms of blocked main thread. // // Invalidated by our own mutations (`epoch`) and by any change to the raw // key count. That is sound for the case that matters: JS is single // threaded, so nothing can mutate storage part-way through a synchronous // walk. A write from another tab lands via the async storage event, after // which `raw.length` no longer matches. var ckKeys = null, ckLen = -1, ckEpoch = -1, epoch = 0; function bump() { epoch++; } function localKeys() { var rawLen = raw.length; if (ckKeys !== null && ckLen === rawLen && ckEpoch === epoch) return ckKeys; var out = [], i, k; for (i = 0; i < rawLen; i++) { k = raw.key(i); if (k !== null && owns(k)) out.push(stripPrefix(k)); } ckKeys = out; ckLen = rawLen; ckEpoch = epoch; return out; } var api = { getItem: function (k) { return raw.getItem(toRaw(String(k))); }, setItem: function (k, v) { var rk = toRaw(String(k)); try { raw.setItem(rk, String(v)); } catch (err) { // Out of quota. Reclaim an idle account's space and try once more; // if it still fails, rethrow so callers see the real error. if (!evictLruPartition()) throw err; raw.setItem(rk, String(v)); } bump(); }, removeItem: function (k) { raw.removeItem(toRaw(String(k))); bump(); }, // Clears this partition only — never another account's data, and never // the device keys that make partitioning work. clear: function () { var ks = localKeys(), i; for (i = 0; i < ks.length; i++) { try { raw.removeItem(toRaw(ks[i])); } catch (e) {} } bump(); }, key: function (i) { var ks = localKeys(); var n = Number(i); return n >= 0 && n < ks.length ? ks[n] : null; } }; // A Proxy rather than a plain object, so the substitute is complete. // `Storage` supports named access and enumeration as well as the six // methods — `lib/brain/sources/roadmap-progress.ts` calls // `Object.keys(window.localStorage)` to find its keys, and against a // plain object that returns the METHOD names and the feature silently // stops finding anything. The traps below keep `Object.keys`, spread, // `in`, `delete` and `localStorage.foo` all behaving as they would on a // real Storage, scoped to this partition. function isApi(p) { return Object.prototype.hasOwnProperty.call(api, p); } return new Proxy(api, { get: function (t, p) { if (typeof p === "symbol") return t[p]; // Real Storage resolves `length` to the count even if a key is // literally named "length"; `getItem('length')` still reads the item. if (p === "length") return localKeys().length; if (isApi(p)) return api[p]; var v = raw.getItem(toRaw(String(p))); return v === null ? undefined : v; }, set: function (t, p, v) { if (typeof p === "symbol") { t[p] = v; return true; } api.setItem(String(p), v); return true; }, has: function (t, p) { if (typeof p === "symbol") return p in t; if (p === "length" || isApi(p)) return true; return raw.getItem(toRaw(String(p))) !== null; }, deleteProperty: function (t, p) { if (typeof p !== "symbol") api.removeItem(String(p)); return true; }, ownKeys: function () { return localKeys(); }, getOwnPropertyDescriptor: function (t, p) { if (typeof p === "symbol") return Object.getOwnPropertyDescriptor(t, p); var v = raw.getItem(toRaw(String(p))); if (v === null) return undefined; // configurable:true is required — a Proxy may not report a // non-configurable descriptor for a key absent from the target. return { value: v, writable: true, enumerable: true, configurable: true }; } }); } // ── storage events: translate keys back, drop other partitions ─────── // ~20 components do `if (e.key !== 'some-key') return`. Without this they // would silently stop matching and cross-tab sync would die everywhere. function installEventTranslation() { var addEL = W.addEventListener, removeEL = W.removeEventListener; if (typeof addEL !== "function") return; var wrapped = new WeakMap(); W.addEventListener = function (type, listener, options) { if (type !== "storage" || typeof listener !== "function") { return addEL.call(W, type, listener, options); } var seen = wrapped.get(listener); if (!seen) { seen = function (e) { // key === null means clear(); it carries no key to translate. if (e.key !== null && e.key !== undefined) { if (isDevice(e.key)) { return listener.call(this, e); } // A same-tab SYNTHETIC event carries the LOGICAL key: app code // dispatches new StorageEvent('storage', { key: 'task-tasks' }) // so same-tab listeners refresh after a write. It is not another // account's write — only a real cross-tab event carries a partition // prefix — so deliver it untouched. Before this, every such event // was dropped for every account but the browser's first one. if (!startsWith(e.key, PPFX)) { return listener.call(this, e); } if (!ownsName(e.key)) return; // another account's write var local = stripPrefix(e.key); var translated; try { translated = new StorageEvent("storage", { key: local, oldValue: e.oldValue, newValue: e.newValue, url: e.url, storageArea: e.storageArea }); } catch (err) { translated = e; // StorageEvent constructor unavailable } return listener.call(this, translated); } return listener.call(this, e); }; wrapped.set(listener, seen); } return addEL.call(W, type, seen, options); }; if (typeof removeEL === "function") { W.removeEventListener = function (type, listener, options) { if (type === "storage" && typeof listener === "function") { var seen = wrapped.get(listener); if (seen) return removeEL.call(W, type, seen, options); } return removeEL.call(W, type, listener, options); }; } } // ── Fail-safe: if the globals can't be replaced, wipe instead ──────── // Losing local data is bad; showing it to the wrong account is worse. function purgeFallback() { var stores = [rawLocal, rawSession], s, i, k, doomed; for (s = 0; s < stores.length; s++) { if (!stores[s]) continue; try { doomed = []; for (i = 0; i < stores[s].length; i++) { k = stores[s].key(i); if (k !== null && !isDevice(k)) doomed.push(k); } for (i = 0; i < doomed.length; i++) { try { stores[s].removeItem(doomed[i]); } catch (e) {} } } catch (e) {} } try { if (W.indexedDB && W.indexedDB.databases) { W.indexedDB.databases().then(function (list) { for (var m = 0; m < list.length; m++) { var n = list[m] && list[m].name; if (n) { try { W.indexedDB.deleteDatabase(n); } catch (e) {} } } })['catch'](function () {}); } } catch (e) {} } // ── Install ────────────────────────────────────────────────────────── // Installed for EVERY partition including the legacy one (empty prefix). // The legacy account writes unprefixed keys and so needs no mapping, but // it still needs the filtered enumeration: without the shim, its // `localStorage.key(i)` walk and `indexedDB.databases()` would list every // other account's prefixed entries. var installed = true; { try { var localShim = scope(rawLocal), sessionShim = scope(rawSession); if (rawLocal) { Object.defineProperty(W, "localStorage", { configurable: true, get: function () { return localShim; } }); } if (rawSession) { Object.defineProperty(W, "sessionStorage", { configurable: true, get: function () { return sessionShim; } }); } var idb = W.indexedDB; if (idb) { var origOpen = idb.open, origDelete = idb.deleteDatabase, origList = idb.databases; idb.open = function (name, version) { return version === undefined ? origOpen.call(idb, prefix + name) : origOpen.call(idb, prefix + name, version); }; idb.deleteDatabase = function (name) { return origDelete.call(idb, prefix + name); }; if (typeof origList === "function") { idb.databases = function () { return origList.call(idb).then(function (list) { var out = [], i, n; for (i = 0; i < list.length; i++) { n = list[i] && list[i].name; if (typeof n === "string" && ownsName(n)) { out.push({ name: stripPrefix(n), version: list[i].version }); } } return out; }); }; } } installEventTranslation(); } catch (e) { installed = false; } // Verify the swap actually took effect — a silent failure here would // leave the next account reading the previous one's data. // // Checked by IDENTITY, not by writing a probe value. A probe write throws // when localStorage is full, and treating that as "the shim failed" would // run the purge below and destroy the user's data over a recoverable // out-of-space condition. It also avoids a write on every page load. try { if (rawLocal && W.localStorage !== localShim) installed = false; if (rawSession && W.sessionStorage !== sessionShim) installed = false; } catch (e) { installed = false; } if (!installed) purgeFallback(); } // ── Record state ───────────────────────────────────────────────────── // Cached page HTML can hold the previous account's rendered data and is // written by the service worker rather than the page, so it is evicted on // a change of account rather than partitioned. var prevOwner = null; if (rawLocal) { try { prevOwner = rawLocal.getItem(K_OWNER); } catch (e) {} } if (prevOwner !== null && prevOwner !== ownerKey) { try { if (typeof caches !== "undefined") { var pfx = ["cowork-mobile-pages"]; caches.keys().then(function (names) { for (var c = 0; c < names.length; c++) { for (var p = 0; p < pfx.length; p++) { if (startsWith(names[c], pfx[p])) caches['delete'](names[c])['catch'](function () {}); } } })['catch'](function () {}); } } catch (e) {} } if (rawLocal) { try { rawLocal.setItem(K_OWNER, ownerKey); } catch (e) {} } touchPartition(); W["__WIZZAD_STORAGE_OWNER__"] = installed ? OWNER : "__WZ_PARTITION_FAILED__"; } catch (fatal) { // Unexpected failure anywhere above: we cannot prove storage is scoped, // so wipe rather than risk showing it to the wrong account, and record // the degraded state so callers know not to reload into it. try { purgeFallback(); } catch (e) {} try { W["__WIZZAD_STORAGE_OWNER__"] = "__WZ_PARTITION_FAILED__"; } catch (e) {} } })();

Check a Wizzad record

Check a credential or a badge