@goliapkg/sentori-react-native 6.2.1 → 6.3.0

package/android/src/main/java-core/com/sentori/SentoriPush.kt

@@ -91,6 +91,35 @@ object SentoriPush {
     private const val PREFS = "com.sentori.push"
     private const val HANDLE_KEY = "handle"
 
+    /**
+     * Which installation this is, kept for as long as the app is
+     * installed.
+     *
+     * The server keys the device row on it, so a vendor rotating its
+     * token becomes an update of the row that already exists rather
+     * than a new row with a new address. Before this, a rotation
+     * silently retired whatever `spToken` a backend was holding.
+     *
+     * Generated here rather than issued by the server because it has
+     * to exist before the first registration, and it never leaves the
+     * device except in that registration — it is not the address, and
+     * an identifier that can claim a row must not be one that travels.
+     */
+    private const val INSTALL_KEY = "install_id"
+
+    /**
+     * The last token the vendor issued, so a sign-in can send the
+     * registration again without asking FCM for a token first.
+     *
+     * It is already in this app's private storage — FCM keeps its own
+     * copy there — so keeping it costs nothing new. The handle stays
+     * the capability; this is only an input to producing one.
+     */
+    private const val TOKEN_KEY = "native_token"
+
+    /** What the server was last told, so a repeat is not sent. */
+    @Volatile private var lastSentIdentity: String? = null
+
     private val worker =
         Executors.newSingleThreadScheduledExecutor { r ->
             Thread(r, "sentori-push").apply { isDaemon = true }
@@ -125,7 +154,7 @@ object SentoriPush {
     ) {
         val config = SentoriConfig.current
         if (config == null) {
-            completion(Result.Failure(Failure.NOT_INITIALISED, "Sentori.start has not run"))
+            deliver(completion, Result.Failure(Failure.NOT_INITIALISED, "Sentori.start has not run"))
             return
         }
 
@@ -138,20 +167,192 @@ object SentoriPush {
         }
 
         val appContext = context.applicationContext
+
+        // Whatever launched this Activity, before anything else can
+        // replace it. A cold start from a notification arrives here
+        // and nowhere else, and `onTap` used to need the host to
+        // forward it by hand — which nothing told the host to do.
+        SentoriNotificationTap.consume(activity)
         val proceed = { status: String ->
             worker.execute {
-                completion(finishRegister(appContext, config, status, timeoutMs))
+                deliver(completion, finishRegister(appContext, config, status, timeoutMs))
             }
         }
 
         val current = SentoriPushNotifications.currentPermission(appContext)
         if (current == "notDetermined" && activity != null) {
-            SentoriPushNotifications.requestPermission(activity) { proceed(it) }
+            // `timeoutMs` is a network budget — how long to wait for a
+            // device token. Spending it on a person reading a dialog
+            // is a category error: the default is eight seconds, and
+            // nobody answers a permission prompt in eight seconds.
+            SentoriPushNotifications.requestPermission(
+                activity,
+                timeoutMs = permissionTimeoutMs,
+            ) { proceed(it) }
         } else {
             proceed(current)
         }
     }
 
+    /**
+     * How long to wait for someone to answer the permission dialog.
+     *
+     * Separate from `timeoutMs`, which is about the network. A person
+     * may be reading, or may have put the phone down; two minutes
+     * covers the first and gives up on the second rather than leaving
+     * a registration that never reports anything.
+     */
+    @JvmStatic
+    var permissionTimeoutMs: Long = 120_000
+
+    /**
+     * A vendor has issued this device a new token; tell the server
+     * now rather than at the next launch.
+     *
+     * `onNewToken` fired and the SDK wrote the value into a field.
+     * Nothing sent it. So from the moment a token rotated until the
+     * host next called `register`, the server held a dead token: the
+     * sends went out, the vendor answered UNREGISTERED, quarantine
+     * retired the device, and it came back at the next launch under a
+     * different address. For an app that stays resident, "the next
+     * launch" is not a bounded wait.
+     *
+     * Only re-registers a device that has registered before —
+     * `spToken` on disk is the evidence. A token arriving for a
+     * device the host never registered is not something to act on
+     * unasked.
+     */
+    @JvmStatic
+    fun handleRotatedToken(context: Context, token: String) {
+        val appContext = context.applicationContext
+        val config = SentoriConfig.current ?: return
+        if (cachedDeviceHandle(appContext) == null) return
+        worker.execute {
+            when (val r = registerWithServer(appContext, token, config)) {
+                is Result.Success -> rememberHandle(appContext, r.handle, token)
+                is Result.Failure ->
+                    android.util.Log.w(
+                        "sentori",
+                        "push re-register after token rotation failed " +
+                            "(${r.reason.reason}): ${r.message}",
+                    )
+            }
+        }
+    }
+
+    /**
+     * Keep the address, in memory and on disk.
+     *
+     * Three callers now — the first registration, a rotation, and the
+     * live test — and three copies of four lines is how two of them
+     * end up writing different keys.
+     */
+    private fun rememberHandle(context: Context, handle: String, token: String? = null) {
+        synchronized(lock) { cachedHandle = handle }
+        val appContext = context.applicationContext
+        appContext
+            .getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+            .edit()
+            .putString(HANDLE_KEY, handle)
+            .apply {
+                // Kept for the sign-in path below, which has no other
+                // way back to a token.
+                if (token != null) putString(TOKEN_KEY, token)
+            }
+            .apply()
+        // From here on, signing in or out updates the row by itself.
+        SentoriScope.setIdentityListener { identityChanged(appContext) }
+    }
+
+    /**
+     * Send the registration again because the person changed.
+     *
+     * Only for a device that has already registered — a stored token
+     * is the evidence, the same rule [handleRotatedToken] uses. Runs
+     * on the worker: `Sentori.user` is synchronous and stays that way.
+     */
+    private fun identityChanged(appContext: Context) {
+        val config = SentoriConfig.current ?: return
+        val prefs = appContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+        val token = prefs.getString(TOKEN_KEY, null) ?: return
+        if (prefs.getString(HANDLE_KEY, null) == null) return
+
+        // `Sentori.user` is a verb an app may call on every screen,
+        // and one request per call is not free to a host.
+        val identity = "${SentoriScope.userKey}\u0000${SentoriScope.traits}"
+        if (identity == lastSentIdentity) return
+        lastSentIdentity = identity
+
+        worker.execute {
+            when (val r = registerWithServer(appContext, token, config)) {
+                is Result.Success -> rememberHandle(appContext, r.handle, token)
+                is Result.Failure -> {
+                    // The row still names the previous person, so the
+                    // next change has to be allowed to try again.
+                    lastSentIdentity = null
+                    android.util.Log.w(
+                        "sentori",
+                        "updating the device after a sign-in failed " +
+                            "(${r.reason.reason}): ${r.message}",
+                    )
+                }
+            }
+        }
+    }
+
+    /**
+     * Register a vendor token directly, for the live test.
+     *
+     * The rotation path can only be exercised against a device that
+     * has registered, and there is no FCM in a test host to get a
+     * first token from. This is the same call `finishRegister` makes
+     * once it has one.
+     */
+    internal fun registerNativeTokenForTests(context: Context, token: String): String? {
+        val config = SentoriConfig.current ?: return null
+        return when (val r = registerWithServer(context.applicationContext, token, config)) {
+            is Result.Success -> {
+                rememberHandle(context, r.handle, token)
+                r.handle
+            }
+            else -> null
+        }
+    }
+
+    /** This installation's id, minted on first use and kept after. */
+    internal fun installId(ctx: Context): String {
+        val prefs = ctx.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+        prefs.getString(INSTALL_KEY, null)?.let { return it }
+        val fresh = java.util.UUID.randomUUID().toString()
+        prefs.edit().putString(INSTALL_KEY, fresh).apply()
+        return fresh
+    }
+
+    /**
+     * Say it out loud, once, where the person wiring this up is
+     * looking.
+     *
+     * A failed `register` reported only to the server is invisible on
+     * the machine where the mistake was made: the integrator has to
+     * finish connecting the dashboard before it can tell them they
+     * have not finished connecting the dashboard. insight found their
+     * first-launch failure by adding a `Log.w` of their own and
+     * taking it out again.
+     *
+     * Warning, never error. A red line in someone else's logcat reads
+     * as "your app is broken", and a host team that believes that
+     * pulls the SDK out.
+     */
+    private fun deliver(completion: (Result) -> Unit, result: Result) {
+        if (result is Result.Failure) {
+            android.util.Log.w(
+                "sentori",
+                "push register failed (${result.reason.reason}): ${result.message}",
+            )
+        }
+        completion(result)
+    }
+
     private fun finishRegister(
         context: Context,
         config: SentoriConfig,
@@ -177,14 +378,9 @@ object SentoriPush {
             }
         }
 
-        return when (val r = registerWithServer(token, config)) {
+        return when (val r = registerWithServer(context, token, config)) {
             is Result.Success -> {
-                synchronized(lock) { cachedHandle = r.handle }
-                context
-                    .getSharedPreferences(PREFS, Context.MODE_PRIVATE)
-                    .edit()
-                    .putString(HANDLE_KEY, r.handle)
-                    .apply()
+                rememberHandle(context, r.handle, token)
                 startDrain()
                 r
             }
@@ -221,7 +417,16 @@ object SentoriPush {
             drainTask?.cancel(false)
             drainTask = null
         }
-        appContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit().remove(HANDLE_KEY).apply()
+        appContext
+            .getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+            .edit()
+            .remove(HANDLE_KEY)
+            .remove(TOKEN_KEY)
+            .apply()
+        // Nothing to follow the person to any more; a later sign-in
+        // must not resurrect a device the host just revoked.
+        SentoriScope.setIdentityListener(null)
+        lastSentIdentity = null
         SentoriPushNotifications.unregisterForRemoteNotifications(appContext)
 
         val config = SentoriConfig.current
@@ -269,7 +474,11 @@ object SentoriPush {
         return null
     }
 
-    private fun registerWithServer(token: String, config: SentoriConfig): Result {
+    private fun registerWithServer(
+        context: Context,
+        token: String,
+        config: SentoriConfig,
+    ): Result {
         val body =
             mutableMapOf<String, Any?>(
                 // `kind`, not `provider`. The React Native SDK sent
@@ -277,6 +486,11 @@ object SentoriPush {
                 // registration it ever attempted.
                 "kind" to "fcm",
                 "nativeToken" to token,
+                // Which installation this is. The server keys the row
+                // on it, so a rotated token updates this device
+                // rather than creating a second one under a new
+                // address.
+                "installId" to installId(context),
                 // No `env`: FCM is one host, with no sandbox and
                 // production split for a token to be wrong about.
             )
@@ -284,6 +498,11 @@ object SentoriPush {
         // can address this device by the person who hit an issue.
         // Absent until the host calls `Sentori.user`.
         SentoriScope.userKey?.let { body["userKey"] = it }
+        // Attributes of the person rather than of the device, kept
+        // apart so a build channel called "pro" cannot answer a send
+        // aimed at the pro plan. Null leaves the row's traits alone;
+        // an empty map clears them, which is what signing out sends.
+        SentoriScope.traits?.let { body["traits"] = it }
 
         var conn: HttpURLConnection? = null
         return try {
@@ -308,7 +527,15 @@ object SentoriPush {
                 // The handle is the `device_tokens` row id, a bare
                 // uuid. The RN SDK parsed it as an `ipt_*` string no
                 // server has ever returned.
-                val handle = JSONObject(text).optString("token_id")
+                // `spToken` is the name; `token_id` is the name the
+                // server shipped under. Reading the new one first and
+                // falling back matters in one direction that is easy
+                // to miss: a self-hosted deployment upgrades on its
+                // own schedule, so an SDK newer than its server is an
+                // ordinary state, and an SDK that only knew the new
+                // name would fail every registration against it.
+                val json = JSONObject(text)
+                val handle = json.optString("spToken").ifEmpty { json.optString("token_id") }
                 if (handle.isNullOrEmpty()) {
                     Result.Failure(Failure.SERVER_REJECTED, "server returned no device token id")
                 } else {
@@ -348,6 +575,8 @@ object SentoriPush {
     }
 
     internal fun resetForTests() {
+        lastSentIdentity = null
+        SentoriScope.setIdentityListener(null)
         synchronized(lock) {
             cachedHandle = null
             onMessage = null

package/android/src/main/java-core/com/sentori/SentoriPushNotifications.kt

@@ -50,6 +50,10 @@ object SentoriPushNotifications {
 
     private var pendingPermissionCallback: ((String) -> Unit)? = null
 
+    private val watcher = java.util.concurrent.Executors.newSingleThreadExecutor { r ->
+        Thread(r, "sentori-push-permission").apply { isDaemon = true }
+    }
+
     // ── status / permission ─────────────────────────────────────
 
     /** Returns `granted` / `denied` / `notDetermined` without
@@ -82,7 +86,12 @@ object SentoriPushNotifications {
      * Callbacks run on the main thread.
      */
     @JvmStatic
-    fun requestPermission(activity: Activity?, completion: (String) -> Unit) {
+    @JvmOverloads
+    fun requestPermission(
+        activity: Activity?,
+        timeoutMs: Long = 60_000,
+        completion: (String) -> Unit,
+    ) {
         val ctx = activity ?: run {
             completion("error:no-activity")
             return
@@ -99,35 +108,89 @@ object SentoriPushNotifications {
             completion("granted")
             return
         }
-        pendingPermissionCallback = completion
+        synchronized(lock) { pendingPermissionCallback = completion }
         ActivityCompat.requestPermissions(
             ctx,
             arrayOf(Manifest.permission.POST_NOTIFICATIONS),
             PERMISSION_REQUEST_CODE,
         )
+        watchForPermission(ctx.applicationContext, timeoutMs)
     }
 
     /**
-     * Hook for the host Activity's `onRequestPermissionsResult`. Not
-     * mandatory — Android dispatches the result back to the same
-     * Activity that requested it, but ActivityCompat's flow doesn't
-     * give us a callback API on older devices. Hosts that want
-     * deterministic delivery can call this from their override.
+     * Fast path for hosts that forward `onRequestPermissionsResult`.
+     *
+     * It used to be the *only* path, and the comment here said the
+     * callback might not fire because "the JS drain loop will still
+     * pick up the granted state next tick". That is true of React
+     * Native and of nothing else. A native host calls `register` and
+     * never hears of this method, so the callback was never invoked,
+     * `finishRegister` never ran, and a first launch registered
+     * nothing at all — silently, with the user having tapped Allow.
+     * The next launch worked, because by then the permission was
+     * already granted and the flow never suspended. New users simply
+     * did not get push until they happened to reopen the app.
      *
-     * The Activity-based ActivityResultLauncher pattern would be
-     * cleaner but requires the Activity to be a ComponentActivity;
-     * we stick with ActivityCompat for broader RN host compat and
-     * accept that the callback may not fire on every device — the
-     * JS drain loop will still pick up the `granted` state next tick.
+     * Nothing needs to call this now. It stays because forwarding the
+     * result resolves in milliseconds instead of on the next poll,
+     * and because hosts that already call it should keep working.
      */
     @JvmStatic
     fun handlePermissionResult(requestCode: Int, grantResults: IntArray) {
         if (requestCode != PERMISSION_REQUEST_CODE) return
-        val cb = pendingPermissionCallback ?: return
-        pendingPermissionCallback = null
         val granted = grantResults.isNotEmpty() &&
             grantResults[0] == PackageManager.PERMISSION_GRANTED
-        cb(if (granted) "granted" else "denied")
+        settlePermission(if (granted) "granted" else "denied")
+    }
+
+    /** Deliver a pending permission outcome exactly once. */
+    private fun settlePermission(status: String) {
+        val cb = synchronized(lock) {
+            pendingPermissionCallback.also { pendingPermissionCallback = null }
+        } ?: return
+        cb(status)
+    }
+
+    /**
+     * Watch the permission the framework actually holds, and settle
+     * when it changes.
+     *
+     * `checkSelfPermission` flips the moment the user answers the
+     * dialog, whether or not anyone forwarded the result — so this
+     * needs no cooperation from the host, works on any Activity
+     * rather than only a `ComponentActivity`, and cannot be defeated
+     * by a host that does not know the hook exists.
+     *
+     * On a background thread, because the caller's thread is never
+     * ours to block. If the user never answers, this settles as
+     * `notDetermined` at the deadline rather than hanging: a
+     * registration that reports nothing is the failure this whole
+     * change is about.
+     */
+    private fun watchForPermission(ctx: Context, timeoutMs: Long) {
+        watcher.execute {
+            val deadline = System.currentTimeMillis() + timeoutMs
+            while (System.currentTimeMillis() < deadline) {
+                if (synchronized(lock) { pendingPermissionCallback } == null) return@execute
+                if (ContextCompat.checkSelfPermission(
+                        ctx,
+                        Manifest.permission.POST_NOTIFICATIONS,
+                    ) == PackageManager.PERMISSION_GRANTED
+                ) {
+                    settlePermission("granted")
+                    return@execute
+                }
+                try {
+                    Thread.sleep(250)
+                } catch (_: InterruptedException) {
+                    return@execute
+                }
+            }
+            // Denied and never-answered are the same observation from
+            // here: the framework only tells them apart through an
+            // Activity that may be gone by now. Say what was seen.
+            settlePermission("notDetermined")
+        }
     }
 
     // ── register / unregister ───────────────────────────────────
@@ -230,8 +293,17 @@ object SentoriPushNotifications {
         }
     }
 
-    /** Called when the user taps a notification (host wires this in
-     *  Activity.onCreate to forward the intent extras). */
+    /**
+     * Record a tap.
+     *
+     * This used to be the only route to `register(onTap:)`, and its
+     * comment said the host wires it in `Activity.onCreate`. Nothing
+     * in the SDK called it and the docs never mentioned it, so a
+     * native host's `onTap` could not fire at all. `SentoriNotificationTap`
+     * now reaches this on its own, from a pending intent the SDK owns
+     * or from the intent an Activity was launched with; this stays
+     * public because a host that already forwards should keep working.
+     */
     @JvmStatic
     fun handleNotificationTap(extras: Map<String, Any?>) {
         synchronized(lock) {
@@ -283,6 +355,85 @@ object SentoriPushNotifications {
         mgr.createNotificationChannel(channel)
     }
 
+    /**
+     * Put a data message in the tray, with a pending intent of ours.
+     *
+     * Nothing here posted a notification before, which left both
+     * kinds of message broken in a different way. A `data` message
+     * reached `onMessage` and the user saw nothing — insight's device
+     * said "No notifications" while the callback had fired. A
+     * `notification` message was drawn by the system, which never
+     * calls this service, so the tap had no way home. Posting it here
+     * is what makes one path work end to end.
+     *
+     * Only messages that carry something to display are posted. A
+     * data message without a title or a body is a silent instruction
+     * to the app, and an app that uses those would not thank us for
+     * turning each one into a notification the user has to dismiss.
+     */
+    @JvmStatic
+    fun postNotification(ctx: Context, data: Map<String, String>) {
+        val title = data["title"]?.takeIf { it.isNotBlank() }
+        val body = data["body"]?.takeIf { it.isNotBlank() }
+        if (title == null && body == null) return
+        if (!NotificationManagerCompat.from(ctx).areNotificationsEnabled()) return
+
+        ensureChannel(ctx)
+        val id = (data["google.message_id"] ?: data["id"] ?: title ?: "").hashCode()
+        val builder = androidx.core.app.NotificationCompat.Builder(
+            ctx,
+            data["channelId"]?.takeIf { it.isNotBlank() } ?: DEFAULT_CHANNEL_ID,
+        )
+            .setSmallIcon(smallIcon(ctx))
+            .setAutoCancel(true)
+            .setPriority(androidx.core.app.NotificationCompat.PRIORITY_DEFAULT)
+        title?.let { builder.setContentTitle(it) }
+        body?.let { builder.setContentText(it) }
+        SentoriNotificationTap.pendingIntent(ctx, data, id)?.let { builder.setContentIntent(it) }
+
+        try {
+            NotificationManagerCompat.from(ctx).notify(id, builder.build())
+        } catch (t: Throwable) {
+            // Losing the tray entry is not worth taking the host down
+            // for — but losing it in silence is what made this cost
+            // insight an afternoon. The channel got created, so they
+            // knew the code had reached `notify`; the tray was empty,
+            // `dumpsys notification` had nothing, and logcat had not
+            // one word. They worked backwards from the channel's
+            // existence to a throw nobody had reported.
+            //
+            // The argument for this line is the same one made when
+            // registration failures started logging, one release
+            // earlier — and then this catch was written silent in the
+            // same release. A failure the host cannot see is the
+            // hardest kind there is.
+            android.util.Log.w("sentori", "push notification not shown: $t")
+        }
+    }
+
+    /**
+     * A small icon that will not throw.
+     *
+     * The host's own, because a push SDK that ships its own artwork
+     * puts a stranger's mark in someone else's tray. But
+     * `applicationInfo.icon` is `0` for an app that declares no
+     * `android:icon` — insight's did not, it drew its logo from a
+     * launch theme — and `notify` throws on an icon of 0 rather than
+     * drawing something ugly. The result was a notification that
+     * silently never appeared.
+     *
+     * A system icon in that case: unbranded and plain, but visible,
+     * and visible is the whole point of the tray.
+     */
+    private fun smallIcon(ctx: Context): Int {
+        val declared = try {
+            ctx.applicationInfo.icon
+        } catch (_: Throwable) {
+            0
+        }
+        return if (declared != 0) declared else android.R.drawable.ic_dialog_info
+    }
+
     private fun isFirebaseAvailable(): Boolean {
         return try {
             Class.forName("com.google.firebase.messaging.FirebaseMessaging")

package/android/src/main/java-core/com/sentori/SentoriScope.kt

@@ -12,8 +12,29 @@ object SentoriScope {
 
     private val lock = Any()
     private var _userKey: String? = null
+    private var _traits: Map<String, Any?>? = null
     private val _context = mutableMapOf<String, Any?>()
 
+    /**
+     * What to tell when the person changes.
+     *
+     * The push device row carries the identity, and nothing updated it
+     * after registration: an app that registers at launch and signs in
+     * ten seconds later — which is every app with a login screen —
+     * held a row with no user on it for the life of the install. A
+     * send aimed at that person reached nobody and said it had worked.
+     *
+     * A callback rather than a call into [SentoriPush], so this file
+     * keeps knowing nothing about push.
+     */
+    @Volatile private var onIdentityChange: (() -> Unit)? = null
+
+    /** Register interest in identity changes. Only push does. */
+    @JvmStatic
+    fun setIdentityListener(listener: (() -> Unit)?) {
+        onIdentityChange = listener
+    }
+
     /**
      * Identify the person using the app. Only the hash goes on the
      * wire; the id and email stay on the device.
@@ -27,9 +48,22 @@ object SentoriScope {
      * Pass null for both to forget the user on sign-out.
      */
     @JvmStatic
-    fun setUser(id: String?, email: String?) {
+    @JvmOverloads
+    fun setUser(id: String?, email: String?, traits: Map<String, Any?>? = null) {
         val key = SentoriIdentity.userKey(id, email)
-        synchronized(lock) { _userKey = key }
+        synchronized(lock) {
+            _userKey = key
+            // A call describes the person completely, so one made
+            // without traits means they have none rather than "leave
+            // the last ones". Absent and empty differ on the wire —
+            // absent keeps what the row has, and a signed-out device
+            // that kept them would still be selectable as whoever
+            // just left.
+            _traits = traits?.toMap() ?: emptyMap()
+        }
+        // Outside the lock: a listener that registers a device must
+        // not be holding this while it makes a request.
+        runCatching { onIdentityChange?.invoke() }
     }
 
     /** Merge keys into the ambient context. Later calls win per key. */
@@ -42,6 +76,17 @@ object SentoriScope {
     val userKey: String?
         get() = synchronized(lock) { _userKey }
 
+    /**
+     * The person's attributes, for the push device row.
+     *
+     * Null until the host has called [setUser] at all, which is
+     * different from an empty map: null leaves the row's traits alone,
+     * empty clears them.
+     */
+    @JvmStatic
+    val traits: Map<String, Any?>?
+        get() = synchronized(lock) { _traits }
+
     /**
      * Null rather than an empty map, so an event with no context omits
      * the field instead of carrying `{}`.
@@ -54,7 +99,9 @@ object SentoriScope {
     fun clear() {
         synchronized(lock) {
             _userKey = null
+            _traits = null
             _context.clear()
         }
+        onIdentityChange = null
     }
 }