@goliapkg/sentori-react-native 6.2.1 → 6.4.0

package/src/__tests__/push.test.ts

@@ -15,7 +15,7 @@ import {
   register,
 } from '../push';
 import { __resetForTests as resetConfig, setConfig } from '../config';
-import { __resetForTests as resetScope } from '../scope';
+import { __resetForTests as resetScope, setUser } from '../scope';
 
 const baseConfig = {
   token: 'st_test',
@@ -202,3 +202,205 @@ describe('push.register', () => {
     expect(seen).not.toBeNull();
   });
 });
+
+// A device registers at launch; the person signs in ten seconds
+// later. Until now nothing updated the row, so it carried no user for
+// the life of the install — and a send aimed at that user reached
+// nobody and reported success.
+describe('push registration follows the person', () => {
+  /** Record every /v1/push/tokens body, so a test can say what the
+   *  server was told rather than that it was told something. */
+  function recordingFetch(): Array<Record<string, unknown>> {
+    const seen: Array<Record<string, unknown>> = [];
+    globalThis.fetch = ((_url: string, init?: { body?: string }) => {
+      if (init?.body != null) {
+        seen.push(JSON.parse(init.body) as Record<string, unknown>);
+      }
+      return Promise.resolve({
+        ok: true,
+        status: 202,
+        json: () => Promise.resolve({ spToken: 'dev-1', token_id: 'dev-1' }),
+      });
+    }) as unknown as typeof fetch;
+    return seen;
+  }
+
+  /** `user()` hashes on a promise, so the key lands a tick later and
+   *  the re-registration is sent after that. */
+  const settle = () => new Promise((r) => setTimeout(r, 10));
+
+  beforeEach(() => {
+    resetPush();
+    resetConfig();
+    resetScope();
+    setPlatform('ios');
+    setConfig(baseConfig);
+    __setNativeForTests(grantingNative());
+  });
+  afterEach(() => {
+    resetPush();
+    resetConfig();
+    resetScope();
+    setPlatform(null);
+    __setNativeForTests(undefined);
+    globalThis.fetch = realFetch;
+  });
+
+  it('sends the identity when the person signs in after registering', async () => {
+    const seen = recordingFetch();
+    await register();
+    expect(seen).toHaveLength(1);
+    expect(seen[0]?.userKey).toBeUndefined();
+
+    setUser({ id: 'usr_123', traits: { plan: 'pro' } });
+    await settle();
+
+    // Two assertions, because either alone passes on a mistake: a
+    // count alone passes if the update carries nothing, and a key
+    // alone passes if the update never happened and this is still the
+    // first request.
+    expect(seen).toHaveLength(2);
+    expect(typeof seen[1]?.userKey).toBe('string');
+    expect(seen[1]?.traits).toEqual({ plan: 'pro' });
+  });
+
+  it('does not send anything when the same person is set again', async () => {
+    const seen = recordingFetch();
+    await register();
+    setUser({ id: 'usr_123', traits: { plan: 'pro' } });
+    await settle();
+    const after = seen.length;
+
+    // `user()` is a verb an app may call on every screen. One request
+    // per call is not free to a host, and the iron rule is that we are.
+    setUser({ id: 'usr_123', traits: { plan: 'pro' } });
+    await settle();
+    expect(seen).toHaveLength(after);
+  });
+
+  it('clears the traits when the person signs out', async () => {
+    const seen = recordingFetch();
+    await register();
+    setUser({ id: 'usr_123', traits: { plan: 'pro' } });
+    await settle();
+    setUser(null);
+    await settle();
+
+    const last = seen[seen.length - 1];
+    expect(last?.userKey).toBeUndefined();
+    // `{}` rather than absent: absent means "keep what is there", so
+    // a signed-out device would stay selectable as a pro user.
+    expect(last?.traits).toEqual({});
+  });
+
+  it('does not register a device that never registered', async () => {
+    const seen = recordingFetch();
+    setUser({ id: 'usr_123' });
+    await settle();
+    expect(seen).toHaveLength(0);
+  });
+});
+
+// A vendor token is not an address. It rotates — on a reinstall, a
+// restore, cleared app data — and the server keys the row on it, so a
+// rotation wrote a *new* row under a *new* spToken and every backend
+// holding the old one was addressing nothing.
+//
+// The native SDKs were given an installId and a rotation report. This
+// package was not: its registration goes through JS, and the native
+// rotation hook it does have refuses to act on a device the *native*
+// side never registered — which, for a React Native app, is every
+// device.
+describe('push survives the vendor rotating its token', () => {
+  function recordingFetch(): Array<Record<string, unknown>> {
+    const seen: Array<Record<string, unknown>> = [];
+    globalThis.fetch = ((_url: string, init?: { body?: string }) => {
+      if (init?.body != null) {
+        seen.push(JSON.parse(init.body) as Record<string, unknown>);
+      }
+      return Promise.resolve({
+        ok: true,
+        status: 202,
+        json: () => Promise.resolve({ spToken: 'dev-1', token_id: 'dev-1' }),
+      });
+    }) as unknown as typeof fetch;
+    return seen;
+  }
+
+  beforeEach(() => {
+    resetPush();
+    resetConfig();
+    resetScope();
+    setPlatform('ios');
+    setConfig(baseConfig);
+  });
+  afterEach(() => {
+    resetPush();
+    resetConfig();
+    resetScope();
+    setPlatform(null);
+    __setNativeForTests(undefined);
+    globalThis.fetch = realFetch;
+  });
+
+  it('tells the server which installation this is', async () => {
+    __setNativeForTests(grantingNative());
+    const seen = recordingFetch();
+    await register();
+    const installId = seen[0]?.installId;
+    expect(typeof installId).toBe('string');
+    expect(String(installId).length).toBeGreaterThan(8);
+  });
+
+  it('keeps the same installation across registrations', async () => {
+    __setNativeForTests(grantingNative());
+    const seen = recordingFetch();
+    await register();
+    await register();
+    expect(seen).toHaveLength(2);
+    // Asserting equality alone passes when neither call sent one —
+    // `undefined === undefined` — which is the state this test
+    // exists to reject. So: a string, and the same string.
+    expect(typeof seen[0]?.installId).toBe('string');
+    expect(seen[1]?.installId).toBe(seen[0]?.installId);
+  });
+
+  it('reports a token that rotated while the app was running', async () => {
+    // The vendor hands back a different token on the second drain,
+    // which is what a rotation looks like from here.
+    let handed = 0;
+    __setNativeForTests(
+      grantingNative({
+        pushDrainState: () => {
+          handed += 1;
+          return Promise.resolve({
+            notifications: [],
+            taps: [],
+            token: handed <= 1 ? 'abc123' : 'rotated456',
+          });
+        },
+      }),
+    );
+    const seen = recordingFetch();
+    await register();
+    expect(seen).toHaveLength(1);
+
+    // One turn of the drain loop, which already runs at 1 Hz and
+    // already reads the token — it just threw it away.
+    await new Promise((r) => setTimeout(r, 1400));
+
+    expect(seen).toHaveLength(2);
+    expect(seen[1]?.nativeToken).toBe('rotated456');
+    // Same installation, or the server writes a second row and the
+    // rotation has achieved exactly what it used to.
+    expect(seen[1]?.installId).toBe(seen[0]?.installId);
+  });
+
+  it('does not report the same token twice', async () => {
+    __setNativeForTests(grantingNative());
+    const seen = recordingFetch();
+    await register();
+    await new Promise((r) => setTimeout(r, 2400));
+    expect(seen).toHaveLength(1);
+  });
+});

package/src/push.ts

@@ -23,7 +23,7 @@
 
 import { logger, pushSignal } from '@goliapkg/sentori-core'
 
-import { currentUserKey } from './scope.js'
+import { currentUserKey, currentUserTraits, onIdentityChange } from './scope.js'
 
 // AppState is RN-only; we treat it dynamically so the SDK keeps
 // importing cleanly under Bun / web.
@@ -44,8 +44,25 @@ import {
 } from './native.js'
 
 const STORAGE_KEY = 'sentori.push.ipt'
+/// Which installation this is.
+///
+/// Minted once and kept, so the server can key the device row on it
+/// rather than on the vendor's token. Without one a rotation writes a
+/// *new* row under a *new* spToken, and every backend holding the old
+/// one is addressing nothing — with nothing to tell it. The native
+/// SDKs were given this; this package registers from JS and was not.
+const INSTALL_KEY = 'sentori.push.install'
 
 let _cachedIpt: null | string = null
+// The last token the vendor handed us, kept so a sign-in can re-send
+// the registration without asking the OS for a token again.
+let _lastNativeToken: null | string = null
+let _lastOptions: PushRegisterOptions = {}
+// What the server was last told. A re-registration that would send
+// the same thing is not sent: `user()` is a verb an app may call on
+// every screen, and one HTTP request per call is not free to a host.
+let _lastSentIdentity: string | null = null
+let _installId: null | string = null
 let _drainInterval: ReturnType<typeof setInterval> | null = null
 let _appStateSubscription: { remove: () => void } | null = null
 let _backgrounded = false
@@ -176,9 +193,13 @@ export async function register(opts: PushRegisterOptions = {}): Promise<PushRegi
     const token = await waitForToken(opts.tokenTimeoutMs ?? 8000)
     const ipt = await registerWithServer(cfg, token, opts)
     _cachedIpt = ipt
+    _lastNativeToken = token
+    _lastOptions = opts
     void persistIpt(ipt)
     opts.onToken?.(ipt)
     bindBufferDrain(opts.onMessage, opts.onTap)
+    // From here on, signing in or out updates the row by itself.
+    onIdentityChange(reRegisterAfterIdentityChange)
     return { ok: true, ipt }
   } catch (e) {
     const err = e instanceof Error ? e : new Error(String(e))
@@ -199,6 +220,29 @@ function fail(
   return { ok: false, message, reason }
 }
 
+/**
+ * Send the registration again because the person changed.
+ *
+ * Only for a device that has already registered — the vendor token is
+ * the evidence, the same rule the native SDKs use for a rotated
+ * token. Nothing here throws and nothing here is awaited by the host:
+ * `user()` is synchronous and stays that way.
+ */
+function reRegisterAfterIdentityChange(): void {
+  const token = _lastNativeToken
+  const cfg = tryGetRuntimeConfig()
+  if (token == null || cfg == null) return
+  const identity = JSON.stringify([currentUserKey() ?? null, currentUserTraits() ?? null])
+  if (identity === _lastSentIdentity) return
+  _lastSentIdentity = identity
+  void registerWithServer(cfg, token, _lastOptions).catch((e: unknown) => {
+    // A failed update leaves the row pointing at the previous person,
+    // so the next change must be allowed to try again.
+    _lastSentIdentity = null
+    logger.warn('push', 'updating the device after a sign-in failed', e)
+  })
+}
+
 /** Internal carrier so the helpers below can name which failure they
  *  are without every one of them returning a result object. */
 class PushRegisterError extends Error {
@@ -228,6 +272,9 @@ export async function unregister(): Promise<void> {
     }
   }
   nativePushUnregister()
+  onIdentityChange(undefined)
+  _lastNativeToken = null
+  _lastSentIdentity = null
   _cachedIpt = null
   void clearPersistedIpt()
   teardownBufferDrain()
@@ -295,6 +342,10 @@ async function registerWithServer(
   // `kind`, not `provider` — the server's field name, which this
   // sent for a year as `provider` and got a 422 for every time.
   const body: Record<string, unknown> = {
+    // Which installation this is. The server keys the row on it, so a
+    // rotated token updates this device rather than creating a second
+    // one under a new address.
+    installId: await installId(),
     kind: isAndroid ? 'fcm' : 'apns',
     nativeToken,
     // The same salted identity hash every event carries, so the
@@ -310,6 +361,12 @@ async function registerWithServer(
   // out it went nowhere. (Insight asked whether it was stored; it was
   // not — 2026-08-11.)
   if (opts.metadata != null) body.metadata = opts.metadata
+  // Attributes of the person rather than of the device, kept apart so
+  // a build channel called "pro" cannot answer a send aimed at the pro
+  // plan. Absent leaves whatever the row already had; `{}` clears it,
+  // which is what signing out sends.
+  const traits = currentUserTraits()
+  if (traits != null) body.traits = traits
   const res = await fetch(joinUrl(cfg.ingestUrl, '/v1/push/tokens'), {
     method: 'POST',
     headers: {
@@ -362,6 +419,45 @@ function teardownBufferDrain(): void {
 async function pumpOnce(): Promise<void> {
   const state = await pushDrainState()
   flushBuffered(state.notifications, state.taps)
+  await reportRotationIfAny(state.token)
+}
+
+/// Tell the server when the vendor has handed the app a different
+/// token from the one it registered with.
+///
+/// Both native layers already route a rotation into the *native*
+/// `SentoriPush.handleRotatedToken`, and that refuses to act on a
+/// device the native side never registered — which, for a React
+/// Native app, is every device: registration goes through JS and the
+/// handle lives in AsyncStorage. So the rotation arrived nowhere, and
+/// the server held a dead token until the host next called
+/// `register()`. For an app that stays resident that is not a bounded
+/// wait.
+///
+/// This is the drain loop that already runs at 1 Hz and already reads
+/// the token; it threw it away. Foreground only, like the rest of the
+/// loop — a rotation while backgrounded is reported on the next tick
+/// after the app comes back, which is bounded.
+async function reportRotationIfAny(token: string | undefined): Promise<void> {
+  if (token == null || token === '' || token === _lastNativeToken) return
+  // Only a device that has registered: a token arriving for one that
+  // never did is not something to act on unasked, which is the rule
+  // both native SDKs follow.
+  if (_lastNativeToken == null) return
+  const cfg = tryGetRuntimeConfig()
+  if (cfg == null) return
+  const previous = _lastNativeToken
+  _lastNativeToken = token
+  try {
+    const ipt = await registerWithServer(cfg, token, _lastOptions)
+    _cachedIpt = ipt
+    void persistIpt(ipt)
+  } catch (e) {
+    // Put it back, or one failed report means the rotation is never
+    // mentioned again and the device is unreachable for good.
+    _lastNativeToken = previous
+    logger.warn('push', 'reporting a rotated token failed', e)
+  }
 }
 
 function flushBuffered(
@@ -487,6 +583,51 @@ function startAppStateWatch(): void {
   }
 }
 
+/// This installation's id, minted on first use and kept after.
+///
+/// Falls back to a module-scoped value when there is no AsyncStorage,
+/// which is the same fallback the handle uses: worse than persistent,
+/// better than nothing, and it still keeps one launch's rotations
+/// pointed at one row.
+async function installId(): Promise<string> {
+  if (_installId != null) return _installId
+  const storage = await tryAsyncStorage()
+  if (storage) {
+    try {
+      const seen = await storage.getItem(INSTALL_KEY)
+      if (typeof seen === 'string' && seen.length > 0) {
+        _installId = seen
+        return seen
+      }
+    } catch {
+      // An unreadable store is a store with nothing in it.
+    }
+  }
+  const fresh = randomId()
+  _installId = fresh
+  if (storage) {
+    try {
+      await storage.setItem(INSTALL_KEY, fresh)
+    } catch (e) {
+      logger.warn('push', 'AsyncStorage.setItem failed', e)
+    }
+  }
+  return fresh
+}
+
+/// A uuid, without requiring one to exist.
+///
+/// `crypto.randomUUID` is present on newer Hermes and absent on older
+/// ones, and this must not be the line that decides whether push
+/// works on an older engine.
+function randomId(): string {
+  const c = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto
+  if (typeof c?.randomUUID === 'function') return c.randomUUID()
+  let out = ''
+  for (let i = 0; i < 32; i++) out += Math.floor(Math.random() * 16).toString(16)
+  return out
+}
+
 async function persistIpt(ipt: string): Promise<void> {
   const storage = await tryAsyncStorage()
   if (!storage) return
@@ -542,9 +683,14 @@ function joinUrl(base: string, path: string): string {
  *  into the next. Production code paths must not call this. */
 export function __resetForTests(): void {
   _cachedIpt = null
+  _installId = null
   _onMessage = undefined
   _onTap = undefined
   _ackQueue = []
+  _lastNativeToken = null
+  _lastOptions = {}
+  _lastSentIdentity = null
+  onIdentityChange(undefined)
   teardownBufferDrain()
 }
 

package/src/scope.ts

@@ -9,12 +9,50 @@ let _user: User | null = null;
 let _userKey: string | undefined;
 let _context: Record<string, unknown> = {};
 let _hashGeneration = 0;
+let _traits: Record<string, unknown> | undefined;
+
+// What to tell when the person changes.
+//
+// The device row carries the identity, and until now nothing updated
+// it after registration: an app that registers for push at launch and
+// signs in ten seconds later — which is every app with a login screen
+// — held a row with no user on it for the life of the install. A send
+// aimed at that user reached nobody and reported success.
+//
+// A callback rather than a direct call because push.ts already imports
+// this file; the arrow has to point one way.
+let _onIdentityChange: (() => void) | undefined;
+
+/** Register interest in identity changes. Only push does. */
+export const onIdentityChange = (fn: (() => void) | undefined): void => {
+  _onIdentityChange = fn;
+};
+
+const announce = (): void => {
+  try {
+    _onIdentityChange?.();
+  } catch {
+    // NEVER rule: whatever the listener does, user() returns.
+  }
+};
 
 export const setUser = safeFn('user', function setUser(u: User | null): void {
   _user = u;
   _userKey = undefined;
+  // A call to `user()` describes the person completely, so one made
+  // without traits means they have none — not "leave the last ones".
+  // Absent and empty are different on the wire: absent keeps what the
+  // row has, and a signed-out device that kept them would still be
+  // selectable as whoever just left.
+  _traits = u?.traits == null ? {} : { ...u.traits };
   const generation = ++_hashGeneration;
-  if (u === null) return;
+  if (u === null) {
+    // Signing out is an identity change too, and the one where a
+    // stale row matters most: the device would otherwise keep
+    // answering to the person who just left.
+    announce();
+    return;
+  }
   // The wire carries only a salted hash — raw identity never leaves
   // the device (breadth × depth needs distinctness, not identity).
   // Hashing is async (WebCrypto); the verb stays synchronous and the
@@ -24,6 +62,9 @@ export const setUser = safeFn('user', function setUser(u: User | null): void {
     .then((hashes) => {
       if (generation === _hashGeneration) {
         _userKey = hashes.id ?? hashes.email;
+        // Announced after the hash lands, not before: the whole point
+        // is to send the new key, and the key is what arrives late.
+        announce();
       }
     })
     .catch(() => {
@@ -39,12 +80,20 @@ export const patchContext = safeFn('context', function patchContext(
 
 export const currentUserKey = (): string | undefined => _userKey;
 
+/** The person's attributes, for the device row. Undefined when the
+ *  host has not set any — which is different from `{}`, the value that
+ *  clears them. */
+export const currentUserTraits = (): Record<string, unknown> | undefined =>
+  _traits === undefined ? undefined : { ..._traits };
+
 export const currentContext = (): Record<string, unknown> | undefined =>
   Object.keys(_context).length > 0 ? { ..._context } : undefined;
 
 export const __resetForTests = (): void => {
   _user = null;
   _userKey = undefined;
+  _traits = undefined;
   _context = {};
+  _onIdentityChange = undefined;
   _hashGeneration++;
 };

package/src/transport.ts

@@ -20,7 +20,7 @@ const STORAGE_KEY = '@sentori/pending';
 const MAX_PERSISTED = 1000;
 
 // Pinned to package.json by a test — bump both together.
-const SDK_VERSION = '6.2.1';
+const SDK_VERSION = '6.4.0';
 
 let _queue: WireEvent[] = [];
 let _assertStats = new Map<string, AssertStat>();