Clear chat drafts and stale document keys on sign-out #444

Summary

On a shared device, two things outlive sign-out. Chat drafts are stored per workspace and room, not per user, so the next person who opens that chat sees the previous person's unsent text. Four localStorage keys also keep the last document's id, slug and Pad title, including a Private one; nothing reads them.

• Severity: Low (shared devices only)
• Area: webapp chat composer, sign-out
• Source: security review of 2026-10-06; left out of Keep the access token out of document page props #429 as a separate outcome

Where

• Drafts key: apps/webapp/src/db/messageComposerDB.ts:58 (${workspaceId}::${roomId}), kept up to 120 days.
• Unused keys written: apps/webapp/src/hooks/useDocumentMetadata.ts:15-19 (docId, padName, slug, title).
• Sign-out: apps/webapp/src/components/settings/hooks/useSignOut.ts.

Fix plan

1. Delete the four localStorage.setItem calls in useDocumentMetadata.ts, after a repo grep confirms nothing reads those keys. On sign-out, remove the four keys once, for existing browsers.
2. On sign-out, clear the composer draft store (memory map and its IndexedDB table) in messageComposerDB.ts, through one exported function that useSignOut calls before signOut().
3. Do not add a user id to the draft key; clearing on sign-out is enough and keeps the store simple.

Acceptance criteria

• After sign-out and a new sign-in on the same browser, no previous draft appears.
• localStorage holds no docId, padName, slug or title key after sign-out.
• Drafts still survive a reload for a signed-in user.

Verify

• Manual: type a draft, sign out, sign in as another user, open the same chat.
• grep -rn "localStorage.getItem('\(docId\|padName\|slug\|title\)')" apps/webapp/src returns nothing before step 1.

Related

• Keep the access token out of document page props #429 (the access token in page props)