fix: detect when Identity verification becomes turned off#1674
Open
nan-li wants to merge 4 commits into
Open
Conversation
A missing jwt_required field previously set the flag off only when it was still unknown, so an app that had Identity Verification on stayed on after it was disabled remotely. Treat a missing field as off unconditionally so the on->off transition is actually detected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…d off While auth is required, requests without a valid JWT are parked per external ID awaiting a token. Once Identity Verification is turned off no token will arrive, so each JWT listener (User, Identity, Subscription, Property, and CustomEvents executors, plus the IAM controller) now releases the parked work and flushes it on the off transition. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
removeInvalidDeltasAndRequests saved updateRequestQueue under both the add and remove request queue keys, corrupting those caches when Identity Verification is enabled. Persist the matching addRequestQueue and removeRequestQueue instead. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add per-executor tests asserting parked requests are released and sent without auth once Identity Verification is turned off, plus OSUserJwtConfig tests verifying a missing jwt_required remote param resolves to off (including the previously-on case) and that an unchanged value does not re-fire listeners. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
|
@claude review |
nan-li
changed the title
nan-li
force-pushed
the
fix/detect_iv_turned_off
branch
from
b000fdc to
aef1699
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
One Line Summary
Detect when Identity Verification is turned off and release any requests that were waiting on a JWT.
Details
Motivation
The SDK detected Identity Verification (IV) turning on but never handled it turning off. Two gaps:
jwt_requiredfield in remote params only set IV off when the value was previously unknown, so an app that had IV on stayed on after it was disabled remotely — the on→off transition was never even produced.OSUserJwtConfigListeneracted on the off transition, so requests parked per-external-id awaiting a JWT (each executor'spendingAuthRequests) were stranded forever — once IV is off, no JWT will ever arrive to release them.Scope
jwt_requiredremote param now always resolves IV to off (including the previously-on case).OSOperationRepo(deltas still flush on the normal poll cadence).removeInvalidDeltasAndRequestspersistedupdateRequestQueueunder the add/remove subscription queue keys.Testing
Unit testing
Added per-executor tests asserting parked requests are released and sent without auth on the off transition, plus
OSUserJwtConfigtests verifying a missingjwt_requiredresolves to off (including previously-on) and that an unchanged value does not re-fire listeners. All pass inOneSignalUserTests.Manual testing
Not tested on a physical device; behavior is covered by the unit tests above.
Affected code checklist
Checklist
Overview
Testing
Final pass