react-native-notify-kit 9.5.0 → 9.6.0

package/android/src/main/java/app/notifee/core/NotifeeAlarmManager.java

@@ -28,9 +28,12 @@ import android.os.Build;
 import android.os.Bundle;
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
+import androidx.annotation.VisibleForTesting;
 import androidx.core.app.AlarmManagerCompat;
 import app.notifee.core.database.WorkDataEntity;
 import app.notifee.core.database.WorkDataRepository;
+import app.notifee.core.event.NotificationEvent;
+import app.notifee.core.model.NotificationAndroidModel;
 import app.notifee.core.model.NotificationModel;
 import app.notifee.core.model.TimestampTriggerModel;
 import app.notifee.core.utility.AlarmUtils;
@@ -44,11 +47,13 @@ import com.google.common.util.concurrent.MoreExecutors;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.concurrent.Executor;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicBoolean;
 
 class NotifeeAlarmManager {
   private static final String TAG = "NotifeeAlarmManager";
@@ -57,6 +62,27 @@ class NotifeeAlarmManager {
   private static final ListeningExecutorService alarmManagerListeningExecutor =
       MoreExecutors.listeningDecorator(alarmManagerExecutor);
 
+  /**
+   * Grace period for stale non-repeating triggers discovered during reboot recovery. Within this
+   * window the trigger is fired once and the Room row is deleted; beyond it the row is deleted
+   * silently to avoid showing stale content. Fix for upstream invertase/notifee#734: on OEM devices
+   * (MIUI, ColorOS, EMUI, FuntouchOS) that suppress BOOT_COMPLETED, zombie rows would otherwise
+   * re-fire on every reboot and never be cleaned.
+   */
+  private static final long STALE_TRIGGER_GRACE_PERIOD_MS = TimeUnit.HOURS.toMillis(24);
+
+  /**
+   * Process-wide guard against concurrent reschedule passes. Set via {@code compareAndSet} at the
+   * entry of {@link #rescheduleNotifications} and cleared on every terminal path. Prevents the
+   * double-advancement race that would occur if {@code RebootBroadcastReceiver} (triggered by
+   * BOOT_COMPLETED) and {@code InitProvider} (triggered by the BOOT_COUNT cold-start recovery added
+   * for upstream invertase/notifee#734) both ran {@code rescheduleNotifications} in parallel: for
+   * past-timestamp repeating triggers, {@code setNextTimestamp} advances the anchor in-place, so
+   * two concurrent passes would skip a full period. Duplicate concurrent requests are logged and
+   * dropped — the winning pass owns the reschedule cycle to completion.
+   */
+  private static final AtomicBoolean rescheduleInProgress = new AtomicBoolean(false);
+
   // Scheduler used only as the timeout clock for Futures.withTimeout on Room
   // writes happening inside BroadcastReceiver.goAsync() scopes. Broadcasts have
   // ~10s before Android kills the process, so we cap the Room wait at 8s and
@@ -71,10 +97,15 @@ class NotifeeAlarmManager {
    * from a {@link BroadcastReceiver#goAsync} scope where the receiver must tell Android "I'm done"
    * within ~10s or the process is killed. Timeouts are logged at {@code WARN} with the supplied
    * {@code logContext}; real failures at {@code ERROR}.
+   *
+   * <p>If {@code beforeFinish} is non-null it is executed immediately before {@code
+   * pendingResult.finish()} on both the success and failure paths. Callers use this hook to release
+   * any process-wide state they acquired before dispatching (e.g. the reschedule lock).
    */
   private static void finishReceiverWhenDone(
       @NonNull ListenableFuture<?> future,
       @Nullable BroadcastReceiver.PendingResult pendingResult,
+      @Nullable Runnable beforeFinish,
       @NonNull String logContext) {
     ListenableFuture<?> bounded =
         Futures.withTimeout(
@@ -84,6 +115,9 @@ class NotifeeAlarmManager {
         new FutureCallback<Object>() {
           @Override
           public void onSuccess(Object result) {
+            if (beforeFinish != null) {
+              beforeFinish.run();
+            }
             if (pendingResult != null) {
               pendingResult.finish();
             }
@@ -102,6 +136,9 @@ class NotifeeAlarmManager {
             } else {
               Logger.e(TAG, "Failure in " + logContext, new Exception(t));
             }
+            if (beforeFinish != null) {
+              beforeFinish.run();
+            }
             if (pendingResult != null) {
               pendingResult.finish();
             }
@@ -182,7 +219,7 @@ class NotifeeAlarmManager {
     // Awaits the Room write before pendingResult.finish(), bounded by the 8s
     // ANR safety timeout. Handles success, failure, and timeout uniformly.
     finishReceiverWhenDone(
-        displayAndPersistFuture, pendingResult, "displayScheduledNotification[" + id + "]");
+        displayAndPersistFuture, pendingResult, null, "displayScheduledNotification[" + id + "]");
   }
 
   public static PendingIntent getAlarmManagerIntentForNotification(String notificationId) {
@@ -268,21 +305,23 @@ class NotifeeAlarmManager {
               pendingIntent);
           break;
         case SET_ALARM_CLOCK:
-          int mutabilityFlag = PendingIntent.FLAG_UPDATE_CURRENT;
-          if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.M) {
-            mutabilityFlag = PendingIntent.FLAG_IMMUTABLE | PendingIntent.FLAG_UPDATE_CURRENT;
-          }
-
-          Context context = getApplicationContext();
-          Intent launchActivityIntent =
-              context.getPackageManager().getLaunchIntentForPackage(context.getPackageName());
-
+          // Build the "show intent" required by AlarmClockInfo — the PendingIntent Android
+          // fires when the user taps the alarm-clock icon rendered in the status bar while
+          // this alarm is pending. Reuse NotificationPendingIntent.createIntent so the tap
+          // funnels through the same NotificationReceiverActivity → onForegroundEvent path
+          // as a normal notification tap, honouring any custom pressAction.launchActivity /
+          // mainComponent the user configured. Building a getLaunchIntentForPackage ad-hoc
+          // (as the upstream PR #749 did) bypasses the pressAction fixes added in 9.1.19 /
+          // 9.3.0 and strands custom routing.
+          Bundle showIntentPressAction = buildShowIntentPressActionBundle(notificationModel);
           PendingIntent pendingLaunchIntent =
-              PendingIntent.getActivity(
-                  context,
-                  notificationModel.getId().hashCode(),
-                  launchActivityIntent,
-                  mutabilityFlag);
+              NotificationPendingIntent.createIntent(
+                  notificationModel.getHashCode(),
+                  showIntentPressAction,
+                  NotificationEvent.TYPE_PRESS,
+                  new String[] {"notification"},
+                  notificationModel.toBundle());
+
           AlarmManagerCompat.setAlarmClock(
               alarmManager, timestampTrigger.getTimestamp(), pendingLaunchIntent, pendingIntent);
           break;
@@ -300,6 +339,41 @@ class NotifeeAlarmManager {
     }
   }
 
+  /**
+   * Resolve the pressAction bundle used to build the AlarmClockInfo show intent for {@link
+   * TimestampTriggerModel.AlarmType#SET_ALARM_CLOCK}. Mirrors the three-case logic in {@code
+   * NotificationManager.displayNotification} so the status-bar alarm-clock icon, when tapped, goes
+   * through the same {@code NotificationReceiverActivity} path as a normal tap:
+   *
+   * <ol>
+   *   <li>pressAction absent → synthesize default {@code { id:'default', launchActivity:'default'
+   *       }} so the tap opens the app (defense-in-depth for triggers rehydrated from Room after an
+   *       app kill, which lose their pressAction bundle).
+   *   <li>pressAction carries the {@link NotificationPendingIntent#PRESS_ACTION_OPT_OUT_ID}
+   *       sentinel (user passed {@code pressAction: null} in JS) → still synthesize the default.
+   *       Unlike a content intent, the status-bar alarm-clock icon has no "non-tappable" mode —
+   *       Android requires a non-null show intent. Opening the launcher is the least-surprising
+   *       fallback and matches stock Clock app behaviour.
+   *   <li>pressAction is a normal bundle → pass through unchanged so custom {@code launchActivity}
+   *       / {@code mainComponent} routing is honoured.
+   * </ol>
+   */
+  @VisibleForTesting
+  static Bundle buildShowIntentPressActionBundle(NotificationModel notificationModel) {
+    NotificationAndroidModel androidModel = notificationModel.getAndroid();
+    Bundle pressAction = androidModel != null ? androidModel.getPressAction() : null;
+
+    if (pressAction == null
+        || NotificationPendingIntent.PRESS_ACTION_OPT_OUT_ID.equals(pressAction.getString("id"))) {
+      Bundle defaultPressAction = new Bundle();
+      defaultPressAction.putString("id", "default");
+      defaultPressAction.putString("launchActivity", "default");
+      return defaultPressAction;
+    }
+
+    return pressAction;
+  }
+
   ListenableFuture<List<WorkDataEntity>> getScheduledNotifications() {
     WorkDataRepository workDataRepository = new WorkDataRepository(getApplicationContext());
     return workDataRepository.getAllWithAlarmManager(true);
@@ -359,6 +433,12 @@ class NotifeeAlarmManager {
           return Futures.immediateFuture(null);
         }
 
+        ListenableFuture<Void> staleResult =
+            handleStaleNonRepeatingTrigger(notificationModel, trigger);
+        if (staleResult != null) {
+          return staleResult;
+        }
+
         scheduleTimestampTriggerNotification(notificationModel, trigger);
         // Persist updated timestamp so next reboot starts from the correct anchor.
         return WorkDataRepository.getInstance(getApplicationContext())
@@ -376,7 +456,133 @@ class NotifeeAlarmManager {
     }
   }
 
+  /**
+   * Handles a stale non-repeating TIMESTAMP trigger found during reboot recovery. A trigger is
+   * "stale" when its {@code repeatFrequency} is {@code null} (one-shot) and its {@code timestamp}
+   * has already passed. Returns a {@link ListenableFuture} describing the stale-handling action, or
+   * {@code null} if the trigger is not stale and the caller should proceed with normal re-arming.
+   *
+   * <p>Within {@link #STALE_TRIGGER_GRACE_PERIOD_MS} of the original fire time the notification is
+   * fired once (late) and the Room row is deleted; beyond the grace period the row is deleted
+   * silently. In both cases the row is removed, preventing the zombie re-fire loop described in
+   * upstream invertase/notifee#734.
+   *
+   * <p>Package-private (not {@code private}) so that {@code NotifeeAlarmManagerHandleStaleTest} in
+   * {@code src/test/java/app/notifee/core/} can exercise the resilient display → delete chain via
+   * the {@code (..., Executor)} overload with {@code MoreExecutors.directExecutor()}.
+   */
+  @Nullable
+  static ListenableFuture<Void> handleStaleNonRepeatingTrigger(
+      NotificationModel notificationModel, TimestampTriggerModel trigger) {
+    return handleStaleNonRepeatingTrigger(
+        notificationModel, trigger, alarmManagerListeningExecutor);
+  }
+
+  /**
+   * Testable overload of {@link #handleStaleNonRepeatingTrigger(NotificationModel,
+   * TimestampTriggerModel)} that accepts the {@link Executor} used for the resilient display →
+   * delete chain. Production callers use the no-executor overload which delegates with the
+   * cached-thread-pool listening executor. Unit tests pass {@code
+   * com.google.common.util.concurrent.MoreExecutors.directExecutor()} so that Mockito's
+   * thread-local {@code mockStatic} intercepts fire on the calling thread instead of a worker
+   * thread where the stubs are inactive.
+   */
+  @VisibleForTesting
+  @Nullable
+  static ListenableFuture<Void> handleStaleNonRepeatingTrigger(
+      NotificationModel notificationModel, TimestampTriggerModel trigger, Executor executor) {
+    if (trigger.getRepeatFrequency() != null) {
+      return null;
+    }
+    long nowMs = System.currentTimeMillis();
+    long triggerTs = trigger.getTimestamp();
+    if (triggerTs >= nowMs) {
+      return null;
+    }
+
+    String id = notificationModel.getId();
+    WorkDataRepository workRepo = WorkDataRepository.getInstance(getApplicationContext());
+    long stalenessMs = nowMs - triggerTs;
+
+    if (stalenessMs > STALE_TRIGGER_GRACE_PERIOD_MS) {
+      Logger.i(
+          TAG,
+          "Deleting stale non-repeating trigger (age "
+              + stalenessMs
+              + "ms > "
+              + STALE_TRIGGER_GRACE_PERIOD_MS
+              + "ms grace period): "
+              + id);
+      return workRepo.deleteById(id);
+    }
+
+    Logger.i(
+        TAG,
+        "Firing stale non-repeating trigger once within grace period (age "
+            + stalenessMs
+            + "ms): "
+            + id);
+
+    // Critical: even if the late-fire fails — because the target notification
+    // channel has been deleted between scheduling and recovery, because the
+    // serialized NotificationModel was written by an older library version
+    // whose shape differs, or because displayNotification throws for any other
+    // reason — we MUST still delete the Room row. Otherwise the zombie re-fire
+    // loop this helper is supposed to break persists across future reboots,
+    // exactly the scenario #734 is about. The within-grace path promises
+    // "attempt to fire, always clean"; the fire-once is best-effort, the delete
+    // is the correctness guarantee. Discovered via the Step 6 smoke dry-run,
+    // which surfaced a NullPointerException in NotificationAndroidModel.getChannelId
+    // and observed the chained deleteById never running.
+    //
+    // Post-Step-6 code review (Step 7) hardened the chain against two further
+    // failure modes the original catchingAsync missed:
+    //
+    //   1. Sync throws from NotificationManager.displayNotification (e.g. an
+    //      NPE from NotificationModel.getAndroid() before the work Callable is
+    //      even constructed) would bypass catchingAsync entirely, because the
+    //      primary input future to catchingAsync did not yet exist. Wrapping
+    //      the call in Futures.submitAsync converts any sync throw from the
+    //      AsyncCallable into a failed future that catchingAsync can observe.
+    //
+    //   2. Throwable.class was too broad — it swallowed Error subclasses
+    //      including OutOfMemoryError, VirtualMachineError, LinkageError,
+    //      AssertionError. On a memory-pressured cold boot (the exact target
+    //      scenario of #734) an OOM inside NotificationCompat.Builder.build()
+    //      would be silently absorbed and the handler would proceed to a Room
+    //      write while the JVM was seconds from termination. Narrowed to
+    //      Exception.class so Errors propagate as batch failures; the
+    //      per-entity catch in rescheduleNotifications leaves the row in Room
+    //      for a genuine retry on the next reboot pass.
+    ListenableFuture<Void> displayAttempt =
+        Futures.submitAsync(
+            () -> NotificationManager.displayNotification(notificationModel, null), executor);
+
+    ListenableFuture<Void> resilientDisplay =
+        Futures.catchingAsync(
+            displayAttempt,
+            Exception.class,
+            t -> {
+              Logger.w(
+                  TAG, "Late-fire of stale trigger " + id + " failed, proceeding to delete row", t);
+              return Futures.immediateFuture(null);
+            },
+            executor);
+
+    return Futures.transformAsync(resilientDisplay, ignored -> workRepo.deleteById(id), executor);
+  }
+
   void rescheduleNotifications(@Nullable BroadcastReceiver.PendingResult pendingResult) {
+    if (!rescheduleInProgress.compareAndSet(false, true)) {
+      Logger.i(TAG, "Reschedule already in progress, skipping duplicate request");
+      if (pendingResult != null) {
+        pendingResult.finish();
+      }
+      return;
+    }
+
+    final Runnable releaseLock = () -> rescheduleInProgress.set(false);
+
     Logger.d(TAG, "Reschedule Notifications on reboot");
     Futures.addCallback(
         getScheduledNotifications(),
@@ -390,6 +596,7 @@ class NotifeeAlarmManager {
                     + " recurring alarms");
 
             if (workDataEntities == null || workDataEntities.isEmpty()) {
+              releaseLock.run();
               if (pendingResult != null) {
                 pendingResult.finish();
               }
@@ -415,14 +622,18 @@ class NotifeeAlarmManager {
             // Awaits all per-entity update futures before finishing the boot
             // receiver, bounded by the 8s ANR safety timeout. Any not-yet-
             // persisted next-fire anchors left behind on timeout will catch up
-            // on the next alarm fire.
+            // on the next alarm fire. The releaseLock runnable is invoked from
+            // inside finishReceiverWhenDone's terminal callbacks (success,
+            // failure, or timeout), guaranteeing the CAS flag is cleared
+            // exactly once on every code path.
             ListenableFuture<List<Void>> combined = Futures.allAsList(updateFutures);
-            finishReceiverWhenDone(combined, pendingResult, "rescheduleNotifications");
+            finishReceiverWhenDone(combined, pendingResult, releaseLock, "rescheduleNotifications");
           }
 
           @Override
           public void onFailure(@NonNull Throwable t) {
             Logger.e(TAG, "Failed to reschedule notifications", new Exception(t));
+            releaseLock.run();
             if (pendingResult != null) {
               pendingResult.finish();
             }

package/android/src/main/java/app/notifee/core/NotificationAlarmReceiver.java

@@ -29,14 +29,25 @@ import android.content.Intent;
  * display chain completes. This is critical on Android 14+ when the app is killed.
  */
 public class NotificationAlarmReceiver extends BroadcastReceiver {
+  private static final String TAG = "NotificationAlarmReceiver";
+
   @Override
   public void onReceive(Context context, Intent intent) {
     PendingResult pendingResult = goAsync();
-
-    if (ContextHolder.getApplicationContext() == null) {
-      ContextHolder.setApplicationContext(context.getApplicationContext());
+    // See RebootBroadcastReceiver for the rationale behind this guard.
+    boolean asyncHandoffSucceeded = false;
+    try {
+      if (ContextHolder.getApplicationContext() == null) {
+        ContextHolder.setApplicationContext(context.getApplicationContext());
+      }
+      NotifeeAlarmManager.displayScheduledNotification(intent.getExtras(), pendingResult);
+      asyncHandoffSucceeded = true;
+    } catch (Throwable t) {
+      Logger.e(TAG, "Failed to display scheduled notification", t);
+    } finally {
+      if (!asyncHandoffSucceeded && pendingResult != null) {
+        pendingResult.finish();
+      }
     }
-
-    NotifeeAlarmManager.displayScheduledNotification(intent.getExtras(), pendingResult);
   }
 }

package/android/src/main/java/app/notifee/core/Preferences.java

@@ -22,6 +22,15 @@ import android.content.SharedPreferences;
 
 class Preferences {
   private static final String PREFERENCES_FILE = "app.notifee.core";
+
+  /**
+   * SharedPreferences key storing the value of {@code Settings.Global.BOOT_COUNT} observed on the
+   * most recent successful app init. Compared against the current {@code BOOT_COUNT} to detect a
+   * reboot since the last app run — the core mechanism of the OEM cold-start recovery added for
+   * upstream invertase/notifee#734.
+   */
+  static final String LAST_KNOWN_BOOT_COUNT_KEY = "notifee_last_known_boot_count";
+
   private static Preferences sharedInstance = new Preferences();
   private SharedPreferences preferences;
 

package/android/src/main/java/app/notifee/core/RebootBroadcastReceiver.java

@@ -20,20 +20,35 @@ package app.notifee.core;
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
-import android.util.Log;
 
 /*
  * This is invoked when the phone restarts to ensure that all notifications created by the alarm manager
  * are rescheduled correctly, as Android removes all scheduled alarms when the phone shuts down.
  */
 public class RebootBroadcastReceiver extends BroadcastReceiver {
+  private static final String TAG = "RebootReceiver";
+
   @Override
   public void onReceive(Context context, Intent intent) {
     PendingResult pendingResult = goAsync();
-    Log.i("RebootReceiver", "Received reboot event");
-    if (ContextHolder.getApplicationContext() == null) {
-      ContextHolder.setApplicationContext(context.getApplicationContext());
+    // Tracks whether the synchronous section successfully handed off to the
+    // async reschedule path. If not, the finally block must call finish() to
+    // avoid leaving the broadcast unterminated — Android will otherwise kill
+    // the process after ~10s and race subsequent reboot broadcasts.
+    boolean asyncHandoffSucceeded = false;
+    try {
+      Logger.i(TAG, "Received reboot event");
+      if (ContextHolder.getApplicationContext() == null) {
+        ContextHolder.setApplicationContext(context.getApplicationContext());
+      }
+      new NotifeeAlarmManager().rescheduleNotifications(pendingResult);
+      asyncHandoffSucceeded = true;
+    } catch (Throwable t) {
+      Logger.e(TAG, "Failed to reschedule notifications after reboot", t);
+    } finally {
+      if (!asyncHandoffSucceeded && pendingResult != null) {
+        pendingResult.finish();
+      }
     }
-    new NotifeeAlarmManager().rescheduleNotifications(pendingResult);
   }
 }

package/android/src/main/kotlin/io/invertase/notifee/HeadlessTask.kt

@@ -204,8 +204,9 @@ class HeadlessTask {
         private val params: WritableMap
 
         init {
-            params.putInt("taskId", taskId)
-            this.params = params
+            val copied = params.copy()
+            copied.putInt("taskId", taskId)
+            this.params = copied
         }
 
         val taskConfig: HeadlessJsTaskConfig