SSS: fix to-device event deletion

This is the one major fix in SSS: only delete to-device events when the
client confirms receipt of the previous response, not simply on every
request!

src/api/client_server/sync/msc4186.rs

@@ -384,14 +384,6 @@ pub(crate) async fn sync_events_v5_route(
 
     let all_joined_rooms = joined_rooms_data(&sender_user);
 
-    if body.extensions.to_device.enabled.unwrap_or(false) {
-        services().users.remove_to_device_events(
-            &sender_user,
-            &sender_device,
-            globalsince,
-        )?;
-    }
-
     #[allow(clippy::if_then_some_else_none)]
     let e2ee = if body.extensions.e2ee.enabled == Some(true) {
         Some(sync_events::v5::response::E2EE {
@@ -458,6 +450,17 @@ pub(crate) async fn sync_events_v5_route(
     );
 
     let to_device = if body.extensions.to_device.enabled == Some(true) {
+        if let Some(until) =
+            body.extensions.to_device.since.and_then(|s| s.parse().ok())
+        {
+            debug!(until, "Deleting to-device events");
+            services().users.remove_to_device_events(
+                &sender_user,
+                &sender_device,
+                until,
+            )?;
+        }
+
         let events = services()
             .users
             .get_to_device_events(&sender_user, &sender_device)?;