From 6919f9681e9a8b162359489d0c027fddf90bc5b7 Mon Sep 17 00:00:00 2001
From: timedout <git@nexy7574.co.uk>
Date: Sat, 29 Aug 2026 14:51:19 +0100
Subject: [PATCH] fix: Remove OTKs and fallback keys when deleting a device

---
 changelog.d/2202.bugfix.md  |  1 +
 src/service/users/device.rs | 28 +++++++++++++++++++++++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/2202.bugfix.md

diff --git a/changelog.d/2202.bugfix.md b/changelog.d/2202.bugfix.md
new file mode 100644
index 000000000..df52cb07d
--- /dev/null
+++ b/changelog.d/2202.bugfix.md
@@ -0,0 +1 @@
+One-time keys and fallback keys are now properly cleaned up when a device is deleted.
diff --git a/src/service/users/device.rs b/src/service/users/device.rs
index 01b644ec5..3b44162f1 100644
--- a/src/service/users/device.rs
+++ b/src/service/users/device.rs
@@ -102,7 +102,33 @@ impl super::Service {
 			.ready_for_each(|key| self.db.todeviceid_events.remove(key))
 			.await;
 
-		// TODO: Remove onetimekeys
+		// Remove one-time keys and fallback keys
+		let mut otk_prefix = user_id.as_bytes().to_vec();
+		otk_prefix.push(0xFF);
+		otk_prefix.extend_from_slice(device_id.as_bytes());
+		otk_prefix.push(0xFF);
+		self.db
+			.onetimekeyid_onetimekeys
+			.keys_prefix_raw(&otk_prefix)
+			.ignore_err()
+			.ready_for_each(|key| {
+				self.db.onetimekeyid_onetimekeys.remove(key);
+			})
+			.await;
+		self.db
+			.fallbackkeyid_fallbackkey
+			.keys_prefix_raw(&prefix)
+			.ignore_err()
+			.ready_for_each(|key| self.db.fallbackkeyid_fallbackkey.remove(key))
+			.await;
+
+		let count = self
+			.services
+			.globals
+			.next_count()
+			.expect("must be able to get the next count")
+			.to_be_bytes();
+		self.db.userid_lastonetimekeyupdate.insert(user_id, count);
 
 		// Remove OAuth session information
 		self.services.oauth.remove_session(user_id, device_id).await;