From 5d883bb3fdaf660b8947151ab8f67b3bc7a1b951 Mon Sep 17 00:00:00 2001
From: Tienson Qin <tiensonqin@gmail.com>
Date: Tue, 7 Apr 2026 17:12:48 +0800
Subject: [PATCH] fix(sync): tolerate legacy plaintext decrypt values

---
 src/main/frontend/worker/sync/crypt.cljs      | 20 +++++++++++++++----
 src/test/frontend/worker/sync/crypt_test.cljs | 13 ++++++++++++
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/src/main/frontend/worker/sync/crypt.cljs b/src/main/frontend/worker/sync/crypt.cljs
index 9afcfd20e6..931d6516c2 100644
--- a/src/main/frontend/worker/sync/crypt.cljs
+++ b/src/main/frontend/worker/sync/crypt.cljs
@@ -27,6 +27,13 @@
 (def ^:private invalid-coerce ::invalid-coerce)
 (def ^:private invalid-transit ::invalid-transit)
 
+(defn- read-transit-safe
+  [value]
+  (try
+    (ldb/read-transit-str value)
+    (catch :default _
+      invalid-transit)))
+
 (defn- native-worker?
   []
   native-env?)
@@ -504,12 +511,17 @@
 (defn <decrypt-text-value
   [aes-key value]
   (assert (string? value) (str "encrypted value should be a string, value: " value))
-  (let [decoded (ldb/read-transit-str value)]
+  (let [decoded (read-transit-safe value)]
     (if (= decoded invalid-transit)
       (p/resolved value)
-      (p/let [value (crypt/<decrypt-text-if-encrypted aes-key decoded)
-              value' (ldb/read-transit-str value)]
-        value'))))
+      (p/let [value (or (crypt/<decrypt-text-if-encrypted aes-key decoded)
+                        decoded)
+              value' (if (string? value)
+                       (read-transit-safe value)
+                       value)]
+        (if (= value' invalid-transit)
+          value
+          value')))))
 
 (defn- encrypt-tx-item
   [aes-key item]
diff --git a/src/test/frontend/worker/sync/crypt_test.cljs b/src/test/frontend/worker/sync/crypt_test.cljs
index 0f6e24e4dc..25e0e20d27 100644
--- a/src/test/frontend/worker/sync/crypt_test.cljs
+++ b/src/test/frontend/worker/sync/crypt_test.cljs
@@ -115,3 +115,16 @@
                           (is (= "decrypt-aes-key" (ex-message e)))
                           (is (zero? @clear-user-rsa-cache-calls*))
                           (done)))))))
+
+(deftest decrypt-text-value-legacy-plaintext-test
+  (async done
+         (-> (p/let [aes-key (crypt/<generate-aes-key)
+                     plaintext "$$$favorites"
+                     encrypted (crypt/<encrypt-uint8array aes-key (.encode (js/TextEncoder.) plaintext))
+                     encrypted-str (ldb/write-transit-str encrypted)
+                     decrypted (sync-crypt/<decrypt-text-value aes-key encrypted-str)]
+               (is (= plaintext decrypted))
+               (done))
+             (p/catch (fn [e]
+                        (is false (str e))
+                        (done))))))