Catch metadata realm decryption.

CHANGELOG.md

@@ -9,6 +9,7 @@
 * Windows `InterprocessCondVar` changes reverted.
 * Fix an issue when using `Results::freeze` across threads with different transaction versions. Previously, copying the `Results`'s tableview could result in a stale state or objects from a future version. Now there is a comparison for the source and desitnation transaction version when constructing `ConstTableView`, which will cause the tableview to reflect the correct state if needed ([#4254](https://github.com/realm/realm-core/pull/4254)).
 * `@min` and `@max` queries on a list of float, double or Decimal128 values could match the incorrect value if NaN or null was present in the list (since 5.0.0).
+* Opening a metadata realm with the wrong encryption key will remove that metadata realm and create a new realm using the new key. [#4285](https://github.com/realm/realm-core/pull/4285)
 
 ### Breaking changes
 * None.

src/realm/object-store/sync/impl/sync_metadata.cpp

@@ -182,7 +182,19 @@ SyncMetadataManager::SyncMetadataManager(std::string path, bool should_encrypt,
         }
     };
 
-    SharedRealm realm = Realm::get_shared_realm(config);
+    m_metadata_config = std::move(config);
+
+    SharedRealm realm;
+    try {
+        realm = get_realm();
+    }
+    catch (const RealmFileException&) {
+        if (!should_encrypt)
+            throw;
+
+        util::File::remove(m_metadata_config.path);
+        realm = get_realm();
+    }
 
     // Get data about the (hardcoded) schemas
     auto object_schema = realm->schema().find(c_sync_userMetadata);
@@ -221,8 +233,6 @@ SyncMetadataManager::SyncMetadataManager(std::string path, bool should_encrypt,
         object_schema->persisted_properties[2].column_key, object_schema->persisted_properties[3].column_key,
         object_schema->persisted_properties[4].column_key};
 
-    m_metadata_config = std::move(config);
-
     m_client_uuid = [&]() -> std::string {
         TableRef table = ObjectStore::table_for_object_type(realm->read_group(), c_sync_clientMetadata);
         if (table->is_empty()) {

test/object-store/sync/metadata.cpp

@@ -23,6 +23,7 @@
 #include <realm/object-store/schema.hpp>
 
 #include <realm/object-store/impl/object_accessor_impl.hpp>
+#include <realm/object-store/impl/realm_coordinator.hpp>
 #include "util/test_utils.hpp"
 
 #include <realm/util/file.hpp>
@@ -513,8 +514,38 @@ TEST_CASE("sync_metadata: encryption", "[sync]") {
 
     SECTION("prohibits opening the metadata Realm with different keys") {
         SECTION("different keys") {
-            SyncMetadataManager first_manager(metadata_path, true, make_test_encryption_key(10));
-            REQUIRE_THROWS(SyncMetadataManager(metadata_path, true, make_test_encryption_key(11)));
+            const auto identity0 = "identity0";
+            const auto auth_url = "https://realm.example.org";
+
+            // Open metadata realm, make metadata
+            std::vector<char> key0 = make_test_encryption_key(10);
+            SyncMetadataManager manager0(metadata_path, true, key0);
+
+            auto user_metadata = manager0.get_or_make_user_metadata(identity0, auth_url);
+            REQUIRE(bool(user_metadata));
+            CHECK(user_metadata->identity() == identity0);
+            CHECK(user_metadata->provider_type() == auth_url);
+            CHECK(user_metadata->access_token().empty());
+            CHECK(user_metadata->is_valid());
+
+            // Close realm
+            _impl::RealmCoordinator::get_coordinator(metadata_path)->clear_cache();
+
+            // Open metadata realm with different key
+            std::vector<char> key1 = make_test_encryption_key(11);
+            SyncMetadataManager manager1(metadata_path, true, key1);
+
+            auto user_metadata1 = manager1.get_or_make_user_metadata(identity0, auth_url, false);
+            // Expect previous metadata to no longer be stored
+            CHECK_FALSE(bool(user_metadata1));
+
+            // But new metadata can still be created
+            const auto identity1 = "identity1";
+            auto user_metadata2 = manager1.get_or_make_user_metadata(identity1, auth_url);
+            CHECK(user_metadata2->identity() == identity1);
+            CHECK(user_metadata2->provider_type() == auth_url);
+            CHECK(user_metadata2->access_token().empty());
+            CHECK(user_metadata2->is_valid());
         }
         SECTION("different encryption settings") {
             SyncMetadataManager first_manager(metadata_path, true, make_test_encryption_key(10));