From 2ec79aaefc62c2edefea8f96e793497098893f13 Mon Sep 17 00:00:00 2001
From: Ben Dean-Kawamura <bdk@mozilla.com>
Date: Tue, 28 Apr 2026 11:08:32 -0400
Subject: [PATCH] Bug 2007416 - wipe individual logins on DecryptionErrors

Also:
  * Set sync_status in `LoginsDb::touch()`
  * Handle missing row for LAST_SYNC_META_KEY in `get_last_sync()`
---
 CHANGELOG.md                     |  7 ++++++-
 components/logins/src/logins.udl |  7 ++++++-
 components/logins/src/store.rs   | 18 +++++++++++++++++-
 3 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 315e730130..2d04c042c8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,12 @@
 # v152.0 (In progress)
 
+## ✨ What's New ✨
+
 ### Breach Alerts
-- New component: `breach-alerts` for storing and retrieving breach alert dismissals by breach ID.
+* New component: `breach-alerts` for storing and retrieving breach alert dismissals by breach ID.
+
+### Logins
+* `run_maintenance()` now optionally deletes undecryptable logins (https://bugzilla.mozilla.org/show_bug.cgi?id=2007416)
 
 [Full Changelog](In progress)
 
diff --git a/components/logins/src/logins.udl b/components/logins/src/logins.udl
index cca405ffed..80cc35c505 100644
--- a/components/logins/src/logins.udl
+++ b/components/logins/src/logins.udl
@@ -302,7 +302,7 @@ interface LoginStore {
     /// This is intended to be run during idle time and will take steps / to clean up / shrink the
     /// database.
     [Throws=LoginsApiError]
-    void run_maintenance();
+    void run_maintenance(optional RunMaintenanceOptions? options=null);
 
     [Self=ByArc]
     void register_with_sync_manager();
@@ -310,3 +310,8 @@ interface LoginStore {
     [Self=ByArc]
     void shutdown();
 };
+
+dictionary RunMaintenanceOptions {
+    // Wipe un-decryptable logins.  These will hopefully come back on the next sync.
+    boolean delete_undecryptable_records_for_remote_replacement=true;
+};
diff --git a/components/logins/src/store.rs b/components/logins/src/store.rs
index 1ddeebc487..369aeef78a 100644
--- a/components/logins/src/store.rs
+++ b/components/logins/src/store.rs
@@ -330,9 +330,13 @@ impl LoginStore {
     }
 
     #[handle_error(Error)]
-    pub fn run_maintenance(&self) -> ApiResult<()> {
+    pub fn run_maintenance(&self, options: Option<RunMaintenanceOptions>) -> ApiResult<()> {
         let conn = self.lock_db()?;
+        let options = options.unwrap_or_default();
         run_maintenance(&conn)?;
+        if options.delete_undecryptable_records_for_remote_replacement {
+            conn.delete_undecryptable_records_for_remote_replacement(conn.encdec.as_ref())?;
+        }
         Ok(())
     }
 
@@ -364,6 +368,18 @@ impl LoginStore {
     }
 }
 
+pub struct RunMaintenanceOptions {
+    pub delete_undecryptable_records_for_remote_replacement: bool,
+}
+
+impl Default for RunMaintenanceOptions {
+    fn default() -> Self {
+        Self {
+            delete_undecryptable_records_for_remote_replacement: true,
+        }
+    }
+}
+
 #[cfg(not(feature = "keydb"))]
 #[cfg(test)]
 mod tests {