[brandonpage]

Summary

• Add DPoP proof, dpop_jkt, nonce retry, key ownership, and persisted-account support for all iOS Native Login session-producing paths.
• Harden reset, identity, refresh, scene, stale-callback, reauthentication, independent browser fallback, and main-thread crypto lifecycle behavior.
• Add the temporary vforcesite htu canonicalization workaround for W-24564590, with removal notes and regression coverage.

Verification

• Serial focused SalesforceSDKCore Native Login, DPoP, OAuth coordinator, refresh coordinator/refresher, OAuth refresh URL, and identity suite: 176 passed.
• Generated iOS Native Login fixture builds, installs, and launches against this local candidate. DPoP-disabled password login completed successfully.

Notes

• DPoP-enabled live Headless Identity login currently returns a sanitized unknownError; the related server-side token validation issue is tracked as W-24564590. The temporary htu workaround is included for validation.

Review follow-up (2026-10-20)

• Require HTTP 400/401, a nonempty DPoP-Nonce header, and exact JSON error=use_dpop_nonce before replaying a Native Login request. Existing non-native helpers are unchanged.
• Add regressions for unrelated/malformed 401 responses, missing nonce headers, and repeated challenges at authorize/token endpoints.
• Published in commit d873bae21.

Follow-up verification

• Local build and authentication regression suites: 208 tests passed on iOS 18.6 with Xcode 26.6, including the new regressions.
• New regression reproduced the extra request against the original PR implementation before the fix.
• Full Core/live verification remains open: the supplied live credentials returned invalid_grant, followed by authenticated REST timeouts. Comparable module-wide coverage remains open.
• CI should validate the updated PR head.

[github-actions]

	1 Warning
⚠️	Big PR, try to keep changes smaller if you can.

Generated by 🚫 Danger

[github-actions]

	1 Warning
⚠️	Static Analysis found an issue with one or more files you modified. Please fix the issue(s).

Clang Static Analysis Issues

File	Type	Category	Description	Line	Col
SFUserAccountManager	Nullability	Memory error	Null passed to a callee that requires a non-null 2nd parameter	1999	15
SFUserAccountManager	Nullability	Memory error	Null passed to a callee that requires a non-null 2nd parameter	2014	15
SFUserAccountManager	Nullability	Memory error	nil passed to a callee that requires a non-null 1st parameter	2743	21
SFUserAccountManager	Nullability	Memory error	nil passed to a callee that requires a non-null 2nd parameter	2978	13

Generated by 🚫 Danger

[github-actions]

	Tests	Passed ✅	Skipped	Failed
SalesforceSDKCore iOS ^18 Test Results	1111 ran	1111 ✅

Test	Result
No test annotations available

[codecov]

Codecov Report

❌ Patch coverage is 87.87879% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.88%. Comparing base (c7d68de) to head (d873bae).
⚠️ Report is 2 commits behind head on dev.

Files with missing lines	Patch %	Lines
...ceSDKCore/Classes/Identity/SFIdentityCoordinator.m	67.94%	25 Missing ⚠️
...SDKCore/Classes/UserAccount/SFUserAccountManager.m	93.51%	12 Missing ⚠️
...Login/NativeLogin/NativeLoginManagerInternal.swift	94.23%	6 Missing ⚠️
...KCore/SalesforceSDKCore/Classes/Util/SFSDKOAuth2.m	68.75%	5 Missing ⚠️
...rceSDKCore/Classes/OAuth/SFOAuthSessionRefresher.m	87.87%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev    #4187      +/-   ##
==========================================
- Coverage   72.20%   69.88%   -2.33%     
==========================================
  Files         254      254              
  Lines       23169    23531     +362     
==========================================
- Hits        16729    16444     -285     
- Misses       6440     7087     +647     

Components	Coverage Δ
Analytics	70.78% <ø> (ø)
Common	71.20% <ø> (-0.19%)	⬇️
Core	64.91% <87.87%> (-3.34%)	⬇️
SmartStore	73.45% <ø> (ø)
MobileSync	88.99% <ø> (ø)

Files with missing lines	Coverage Δ
...SalesforceSDKCore/Classes/OAuth/DPoP/DPoPURL.swift	100.00% <100.00%> (ø)
...lesforceSDKCore/Classes/OAuth/SFOAuthCoordinator.m	59.63% <100.00%> (-7.96%)	⬇️
...KCore/Classes/OAuth/SFSDKTokenRefreshCoordinator.m	90.43% <100.00%> (+0.43%)	⬆️
...rceSDKCore/Classes/OAuth/SFOAuthSessionRefresher.m	90.82% <87.87%> (-2.80%)	⬇️
...KCore/SalesforceSDKCore/Classes/Util/SFSDKOAuth2.m	69.59% <68.75%> (-13.13%)	⬇️
...Login/NativeLogin/NativeLoginManagerInternal.swift	57.38% <94.23%> (+21.86%)	⬆️
...SDKCore/Classes/UserAccount/SFUserAccountManager.m	65.13% <93.51%> (-4.78%)	⬇️
...ceSDKCore/Classes/Identity/SFIdentityCoordinator.m	60.18% <67.94%> (+1.98%)	⬆️

... and 32 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

	Tests	Passed	Skipped	Failed ❌️
AuthFlowTester UI Test Results all	1 ran			1 ❌

Test	Result
AuthFlowTester UI Test Results all
AuthFlowTesterUITests.xctest
LegacyLoginTests.testCAOpaque_DefaultScopes_WebServerFlow()	❌ failure