Keep every signed-in account live (#6299)

* Keep every signed-in account live

With the multi-account flag on, the accounts other than the active one are now
restored at launch, one after the other once the active account's UI is up.
They run their migrations, sync while the app is active, get a pusher (appended
so accounts on the same homeserver keep each other's) and count towards the app
badge, and background refresh and search backfill cover them too. Only the
active account's remote settings are ever applied.

Calls stay with the active account until the call service handles every account,
and an auth error on another account is only logged until accounts can be signed
out one at a time. With the flag off only the active account is live, as before.

* Sum the app badge across every signed in account

Each live account now reports its own unread count, and the app badge
shows their sum. Delivered notifications are only cleared for the
account whose rooms were read, so a room shared by two accounts keeps
the other account's notifications.

The room list observer for the badge and the notifications moves from
the UserSessionFlowCoordinator to the AppCoordinator's per-account
wiring. The flow keeps updating the chats tab badge.

* Let the user session manager manage every session

- The AppCoordinator tells the manager to pause, resume, go offline or
  run the search backfill, instead of looping over the sessions itself.
- The manager also restores the other accounts, preparing each with the
  AppCoordinator's migrations and wiring, and resumes them while the
  services are running. With a single account nothing changes.
- Wiring an account again (e.g. after clearing the cache) replaces its
  observers rather than adding to them.
- Add addAccountFlowEnabled, a developer-only switch for the upcoming
  add account flow. It isn't a user preference, so testers enabling
  multi-account can't add a second account yet.

* Apply review suggestions to keeping every account live

- Move the notification changes (pushers for every account, the summed
  app badge and per-account clearing) to their own PR, so notifications
  follow the active account again for now.
- Revert loading only the active account's remote settings: they load in
  the store again, as on develop, until the hooks are reworked.
- The user session manager reports the auth errors of every live session,
  so the AppCoordinator subscribes once instead of keeping per-account
  observers.
- Restoring a single account is private to the manager now.
- Rename otherSessionsRestoreTask to otherSessionsRestorationTask.

* Restore every signed in account through one path

The user session manager now restores every account in a single pass,
most recently selected first, instead of separate restores for the
active account and the others. The AppCoordinator shows the first
account that comes back and no longer reads the multi-account flag:
without it, the manager only ever makes one account live.

- Clearing the cache clears every live account, and the next pass
  replaces their sessions.
- Each account is migrated once per launch, and an account that just
  signed in is never migrated.
- A pass also runs after signing in, so the other accounts come live.
- Remove UserSessionManagerError, restoreActiveSession and
  restoreOtherSessions.

* Only clear the cache of the active account

Clearing the cache goes back to clearing the account shown in the UI.
Its session stays live until the next restore pass replaces it, and when
that restore fails another live account becomes the active one.

* Apply review suggestions to restoring every account

- Remove the search backfill guard: with no sessions the manager starts
  nothing and reports that nothing is running, so the task completes.
- Add a TODO to switch to the most recently used account when the
  active one signs out while others are signed in (element-meta#3325).
- Disable SwiftLint's type_body_length on the AppCoordinator again, it's
  just over the limit with develop's new migrations.

ElementX/Sources/Application/AppCoordinator.swift

@@ -15,6 +15,7 @@ import Sentry
 import SwiftUI
 import Version
 
+// swiftlint:disable:next type_body_length
 class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDelegate, NotificationManagerDelegate, SecureWindowManagerDelegate {
     private let stateMachine: AppCoordinatorStateMachine
     private let navigationRootCoordinator: NavigationRootCoordinator
@@ -37,6 +38,10 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
     private var backgroundRefreshSyncObserver: AnyCancellable?
     
     private var userSessionMigrationsOldVersion: Version?
+    /// The accounts migrated since launch, so restoring one again (e.g. after clearing the cache) never migrates it twice.
+    private var migratedUserIDs: Set<String> = []
+    /// Restores the signed in accounts. Cancelled when signing out or clearing the cache.
+    private var restorationTask: Task<Void, Never>?
     private var userSession: UserSessionProtocol? {
         userSessionManager.activeSession
     }
@@ -48,7 +53,6 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
     private var userSessionFlowCoordinator: UserSessionFlowCoordinator?
     private var softLogoutCoordinator: SoftLogoutScreenCoordinator?
     private var appDelegateObserver: AnyCancellable?
-    private var userSessionObserver: AnyCancellable?
     /// Becomes `true` once the app is no longer waiting on a session restore, whatever the outcome.
     private let isSessionRestoredSubject = CurrentValueSubject<Bool, Never>(false)
     private var clientProxyObserver: AnyCancellable?
@@ -161,6 +165,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
         setupStateMachine()
         
         observeApplicationState()
+        observeUserSessionChanges()
         observeAppLockChanges()
         
         registerBackgroundAppRefresh()
@@ -369,6 +374,8 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
     // MARK: - AuthenticationFlowCoordinatorDelegate
     
     func authenticationFlowCoordinator(didLoginWithSession userSession: UserSessionProtocol) {
+        // A new login has nothing to migrate.
+        migratedUserIDs.insert(userSession.clientProxy.userID)
         userSessionManager.add(userSession)
         configureActiveSession()
         authenticationFlowCoordinator = nil
@@ -490,7 +497,10 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
     
     // swiftlint:disable:next cyclomatic_complexity
     private func performUserSessionMigrations(_ userSession: UserSessionProtocol) async {
-        guard let oldVersion = userSessionMigrationsOldVersion else { return }
+        guard let oldVersion = userSessionMigrationsOldVersion,
+              migratedUserIDs.insert(userSession.clientProxy.userID).inserted else {
+            return
+        }
         
         MXLog.info("Migrating user session from \(oldVersion)")
         
@@ -549,8 +559,6 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
                 }
             }
         }
-        
-        userSessionMigrationsOldVersion = nil
     }
     
     /// This could be removed once the adoption of 25.06.x is widespread.
@@ -661,8 +669,9 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
                 startAuthentication()
             case (.signedOut, .createdUserSession, .signedIn):
                 setupUserSession(isNewLogin: true)
+                restoreUserSessions()
             case (.initial, .startWithExistingSession, .restoringSession):
-                restoreUserSession()
+                restoreUserSessions()
             case (.restoringSession, .failedRestoringSession, .signedOut):
                 showLoginErrorToast()
                 presentSplashScreen()
@@ -670,6 +679,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
                 setupUserSession(isNewLogin: false)
             case (.softLogout, .createdUserSession, .signedIn):
                 setupUserSession(isNewLogin: false)
+                restoreUserSessions()
                 
             case (.signingOut, .signOut, .signingOut):
                 // We can ignore signOut when already in the process of signing out,
@@ -697,21 +707,37 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
         }
     }
     
-    private func restoreUserSession() {
-        Task {
-            switch await userSessionManager.restoreActiveSession() {
-            case .success(let userSession):
-                await self.performUserSessionMigrations(userSession)
-                userSessionManager.add(userSession)
-                configureActiveSession()
-                stateMachine.processEvent(.createdUserSession)
-            case .failure:
+    private func restoreUserSessions() {
+        let previousRestorationTask = restorationTask
+        restorationTask = Task {
+            // A cancelled restoration may still be building a client, which mustn't share a store with a new one.
+            await previousRestorationTask?.value
+            
+            await userSessionManager.restoreSessions { [weak self] userSession in
+                await self?.performUserSessionMigrations(userSession)
+            } didAdd: { [weak self] _ in
+                self?.showActiveSessionIfRestoring()
+            }
+            
+            guard !Task.isCancelled else { return }
+            // An account that was already live becomes the active one when those before it fail (e.g. after clearing the cache).
+            showActiveSessionIfRestoring()
+            
+            if stateMachine.state == .restoringSession {
                 MXLog.error("Failed to restore an existing session.")
                 stateMachine.processEvent(.failedRestoringSession)
             }
         }
     }
     
+    /// Shows the active session as soon as it's live, while the app is waiting for one.
+    private func showActiveSessionIfRestoring() {
+        guard stateMachine.state == .restoringSession, userSession != nil else { return }
+        
+        configureActiveSession()
+        stateMachine.processEvent(.createdUserSession)
+    }
+    
     private func startAuthentication() {
         let encryptionKeyProvider = EncryptionKeyProvider()
         let classicAppManager = ClassicAppManager()
@@ -792,6 +818,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
                     
                     switch action {
                     case .signedIn(let session):
+                        self.migratedUserIDs.insert(session.clientProxy.userID)
                         self.userSessionManager.add(session)
                         self.configureActiveSession()
                         self.softLogoutCoordinator = nil
@@ -868,6 +895,8 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
             fatalError("User session not setup")
         }
         
+        // TODO: With other accounts signed in, switch to the most recently used one instead (element-hq/element-meta#3325).
+        restorationTask?.cancel()
         windowManager.closeAllSecondaryWindows()
         
         showLoadingIndicator()
@@ -915,8 +944,6 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
     private func tearDownUserSession() {
         userIndicatorController.retractAllIndicators()
         
-        userSessionObserver?.cancel()
-        
         userSessionFlowCoordinator = nil
         
         notificationManager.setUserSession(nil)
@@ -947,21 +974,16 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
             fatalError("User session not setup")
         }
         
-        configureServices(for: userSession)
+        // TODO: Calls only follow the active account, ElementCallService must change to hold every account's session.
+        elementCallService.setUserSession(userSession)
+        // TODO: Notifications only follow the active account, the NotificationManager must change to handle every account.
+        configureNotificationManager(for: userSession)
         Task {
             await resumeClientServices()
             await appHooks.configure(with: userSession)
         }
     }
     
-    /// Wires the services that work for every signed in account, not only the active one. They only hold a single session for now.
-    private func configureServices(for userSession: UserSessionProtocol) {
-        userSessionObserver?.cancel()
-        elementCallService.setUserSession(userSession)
-        configureNotificationManager(for: userSession)
-        observeUserSessionChanges(userSession)
-    }
-    
     private func configureNotificationManager(for userSession: UserSessionProtocol) {
         notificationManager.setUserSession(userSession)
         
@@ -977,16 +999,22 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
             }
     }
     
-    private func observeUserSessionChanges(_ userSession: UserSessionProtocol) {
-        userSessionObserver = userSession.callbacks
+    private func observeUserSessionChanges() {
+        userSessionManager.callbacksPublisher
             .receive(on: DispatchQueue.main)
             .sink { [weak self] callback in
                 guard let self else { return }
                 switch callback {
-                case .didReceiveAuthError(let isSoftLogout):
+                case .didReceiveAuthError(let userID, let isSoftLogout):
+                    // Only the active account can be signed out for now.
+                    guard userID == userSessionManager.activeSession?.clientProxy.userID else {
+                        MXLog.error("Ignoring an auth error for \(userID), it isn't the active account.")
+                        return
+                    }
                     stateMachine.processEvent(.signOut(isSoft: isSoftLogout, disableAppLock: false))
                 }
             }
+            .store(in: &cancellables)
     }
     
     private func observeAppLockChanges() {
@@ -1009,6 +1037,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
             fatalError("User session not setup")
         }
         
+        restorationTask?.cancel()
         showLoadingIndicator()
         
         navigationRootCoordinator.setRootCoordinator(PlaceholderScreenCoordinator(hideBrandChrome: appSettings.hideBrandChrome))
@@ -1018,7 +1047,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
         
         // Allow for everything to deallocate properly
         Task {
-            await userSession.clientProxy.clearCaches()
+            await userSessionManager.clearCaches(userID: userSession.clientProxy.userID)
             stateMachine.processEvent(.startWithExistingSession)
             hideLoadingIndicator()
         }
@@ -1163,7 +1192,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
             return
         }
         
-        await userSession?.clientProxy.pauseServices()
+        await userSessionManager.pauseServices()
         clientProxyObserver = nil
     }
     
@@ -1172,7 +1201,7 @@ class AppCoordinator: AppCoordinatorProtocol, AuthenticationFlowCoordinatorDeleg
         
         analyticsService.signpost.startTransaction(.upToDateRoomList)
         
-        await userSession.clientProxy.resumeServices()
+        await userSessionManager.resumeServices()
         
         guard clientProxyObserver == nil else {
             return
@@ -1364,7 +1393,7 @@ private extension AppCoordinator {
         
         // Configure the background-refresh sync to carry set_presence=offline so it doesn't mark the
         // user online or idle. Note: If already online/idle then setting offline shouldn't override that.
-        _ = await userSession.clientProxy.configurePresence(.offline, sendImmediately: false)
+        await userSessionManager.configurePresence(.offline, sendImmediately: false)
         
         await resumeClientServices()
         
@@ -1442,20 +1471,15 @@ private extension AppCoordinator {
         
         await waitForSessionRestore()
         
-        guard let clientProxy = userSession?.clientProxy else {
-            task.setTaskCompleted(success: false)
-            return
-        }
-        
         task.expirationHandler = { @Sendable [weak self] in
             MXLog.info("Search backfill task is about to expire.")
-            Task { @MainActor in self?.userSession?.clientProxy.stopSearchBackfill() }
+            Task { @MainActor in self?.userSessionManager.stopSearchBackfill() }
         }
         
-        clientProxy.startSearchBackfill(strategy: .background)
+        userSessionManager.startSearchBackfill(strategy: .background)
         
-        // TaskHandle can't be awaited, so poll until the sweep finishes or is stopped on expiry.
-        while clientProxy.isSearchBackfillRunning {
+        // TaskHandle can't be awaited, so poll until every sweep finishes or is stopped on expiry.
+        while userSessionManager.isSearchBackfillRunning {
             try? await Task.sleep(for: .seconds(1))
         }