Port forcedotcom#4098: fix nil-sceneId crash on advanced-auth browser callback (unit 43/49)

Semantic re-implementation FROM forcedotcom/dev e4e8388 INTO the ObjC->Swift
migration branch. OAuth advanced-auth (ASWebAuthenticationSession) scene fix.

When advanced-auth login starts before any UIScene has connected (cold launch),
or the weak authSession deallocates before the browser callback fires, sceneId
was nil and got inserted into the URL-handler options dictionary, crashing on
the nil insert and dropping the session from the authSessions store.

Ported into the compiled Swift twins:
- SFSDKAuthSession.swift: synthesize a unique per-session scene id
  (com.salesforce.mobilesdk.unscopedAuthSession-<UUID>) when no scene is
  connected. This also fixes a latent collision in the migration, where the
  non-optional sceneId defaulted to "" and all scene-less sessions shared one
  authSessions[] key.
- SFOAuthCoordinator.swift: browserCallbackOptions(forSceneId:) omits the key
  when the id is nil (empty dict) instead of inserting nil; the URL handler then
  falls back to the default scene. Helper is internal (visible to @testable),
  no new public API.

De-referenced .m files (SFSDKAuthSession.m, SFOAuthCoordinator.m,
SFOAuthCoordinatorTests.m) ref-synced byte-faithful to upstream for clean future
merges; SFOAuthCoordinator+Internal.h is a migration tombstone (skip). The 4 new
tests were also ported to the compiled Swift twin SFOAuthCoordinatorTests.swift.

SDKCore/SmartStore/MobileSync TEST BUILD SUCCEEDED (0 errors, 0 new warnings);
6 SFOAuthCoordinatorTests pass. Marker advanced 42->43 (e4e8388).

Escalation: OAuth advanced-auth/scene callback behavior -- flag in PR.

Author: JohnsonEricAtSalesforce

.claude/pr-escalation-digest.md

@@ -256,8 +256,26 @@ merges. (3) `SKILL.md` update is byte-identical to upstream (`SQLLite`→`SQLite
 build-cache artifact, not a code issue. SmartStore/MobileSync TEST BUILD green; 3 version tests pass (runtime-confirmed
 `4.17.0 community` / SQLite `3.53.3`). **Escalation = SQLCipher dependency bump — flag in PR (pre-approved).**
 
+### Unit 43 · #4098 — nil-sceneId crash on advanced-auth browser callback (OAuth/scene)
+**Escalation class: OAuth advanced-authentication flow / scene routing.** No public API change; behavior fix in the
+native-browser (`ASWebAuthenticationSession`) login path.
+**The bug:** when advanced-auth login starts before any `UIScene` has connected (cold launch, extension-driven login) —
+or the weak `authSession` deallocates before the browser callback fires — the callback built its URL-handler options
+dictionary as `@{kSFIDPSceneIdKey : sceneId}` with a nil `sceneId`, crashing on the nil insert and dropping the session.
+**The fix (2 parts):** (1) `SFSDKAuthSession` synthesizes a unique per-session scene id (`com.salesforce.mobilesdk.unscopedAuthSession-<UUID>`)
+when no scene is connected, so every session gets its own `authSessions[]` key; (2) `SFOAuthCoordinator.browserCallbackOptions(forSceneId:)`
+omits the key entirely when the id is nil, letting the URL handler fall back to the default scene.
+**Reviewer notes:** (1) All production changes land in the compiled Swift twins (`SFSDKAuthSession.swift`,
+`SFOAuthCoordinator.swift`); the de-referenced `.m` files were ref-synced byte-faithful for clean future merges;
+`SFOAuthCoordinator+Internal.h` is a migration tombstone (no class-ext body) so the helper decl lives on the Swift class
+as `internal` (visible to `@testable`, no new public API). (2) **Migration-specific extra:** the migrated `sceneId` was a
+non-optional `String` defaulting to `""`, so it never *crashed* — but it had a latent **collision** bug (all scene-less
+sessions shared the empty-string key). This port fixes that collision too, matching upstream's per-session-unique intent.
+(3) The 4 new tests were both ref-synced into the de-ref `SFOAuthCoordinatorTests.m` (verbatim) and ported to the compiled
+Swift twin. SDKCore/SmartStore/MobileSync build green (0 new warnings — 2 pre-existing unrelated warnings confirmed
+unchanged); 6 SFOAuthCoordinatorTests pass. **Escalation = OAuth advanced-auth/scene callback behavior — flag in PR.**
+
 ## Pending escalation units (upcoming — port in order)
-- **43 · #4098 — OAuth/scene:** nil-sceneId crash fix on advanced-auth browser callback.
 - **44 · #4087 — OAuth/token (LIVE-AUTH UNBLOCKER):** token-refresh coordinator; 18 files. Unblocks Phase 2.
 - **45 · #4102 — OAuth/token:** improve token-refresh error handling.
 - **46 · #4105 — login-host:** iOS26 login-host classifier fix.

.claude/upstream-sync-backlog.md

@@ -1,6 +1,6 @@
 # Upstream Sync Backlog Ledger
 
-Marker (done floor): `303013dd7` (units 1-42 done)  ·  forcedotcom/dev HEAD (target): `b5d37d807`  ·  **7 units remaining**  ·  Re-seeded: 2026-07-19 (Phase 0 of the resume-porting plan).
+Marker (done floor): `e4e838863` (units 1-43 done)  ·  forcedotcom/dev HEAD (target): `b5d37d807`  ·  **6 units remaining**  ·  Re-seeded: 2026-07-19 (Phase 0 of the resume-porting plan).
 
 > **Direction:** we port changes **FROM** `forcedotcom/dev` **INTO** our ObjC→Swift migration branch
 > (`feature/objc-to-swift-test-migration`). Each unit is a *semantic re-implementation* against the current
@@ -17,7 +17,7 @@ Marker (done floor): `303013dd7` (units 1-42 done)  ·  forcedotcom/dev HEAD (ta
 > non-libs (CI, docs, skills, sample apps). Live progress bar = subject of lead task #9.
 
 ## Migration status
-▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░░  42/49 units done (86%)   ·   libs-production-impacting: 15/21   ·   Phase 1 porting (units 1-42 ✅)
+▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓░░  43/49 units done (88%)   ·   libs-production-impacting: 16/21   ·   Phase 1 porting (units 1-43 ✅)
 
 | Bucket | Count | Notes |
 |--------|-------|-------|
@@ -73,7 +73,7 @@ Marker (done floor): `303013dd7` (units 1-42 done)  ·  forcedotcom/dev HEAD (ta
 | 40 | #4088 invalid login-host recovery | a2a271cca | B | ⚠ login-host + L10n(pre-appr) | ✅ ported 6263a436e4127e450592d5be35410ecbce8d9f53 | Validate login-host input; recover to previous host when the current one fails. Ported into compiled Swift twins: **NewLoginHostView.swift** (per-field inline error UI: `NewLoginHostField.errorMessage`/`errorAccessibilityID`; `save(...)` validates non-empty + contains `.` + no whitespace + parseable `https://` URL, sets `hostError`=`LOGIN_INVALID_HOST` and bails on invalid; `.onChange(of: host)` clears error) — twin diverged from pre-image only in 2 `init` API-parity lines (outside change regions) so applied hunks surgically. **SFUserAccountManager.swift** (new `internal var previousLoginHost`; set in `hostListViewController(_:didChange:)`; recovery rewrite in `hostConnectionErrorHandlerBlock` completion: only auto-remove a *deletable* failing host on a **strong-bad-host** signal [`kSFOAuthErrorInvalidURL` / `NSURLErrorBadURL`/`UnsupportedURL`/`AppTransportSecurityRequiresSecureConnection`], NOT on ambiguous DNS/timeout [captive-portal safety]; recovery host = `previousLoginHost` if still in storage else `loginHost(at:0)` guarded by `numberOfLoginHosts>0` to avoid range trap on empty storage). L10n `LOGIN_INVALID_HOST` (pre-approved). Test-visibility: relaxed `SFSDKLoginHostStorage.loginHostList` `private`→`internal` (mirrors ObjC test's KVC reach into the private ivar; no new public API). De-ref ref-sync: `SFUserAccountManager+Internal.h` — added `previousLoginHost` @property to the `#if !defined(SWIFT_CLASS)` ObjC class-extension region verbatim (anchor `nativeLoginEnabled`→`setCurrentUserInternal` matched pre-image; header has NO compiled consumer — all 7 importer `.m` de-referenced — but kept in sync for clean future merges). Stub SKIP (no matching region): `SFUserAccountManager.m` (79-line stub). Tests: NEW ObjC `SFUserAccountManagerLoginHostRecoveryTests.m` (357 lines, `method_exchangeImplementations` swizzle + KVC) ported to a **Swift twin** `SFUserAccountManagerLoginHostRecoveryTests.swift` (9 tests: previousLoginHost capture, restore-to-previous, index-0 fallback ×2, strong-signal removal, ambiguous/DNS keep, empty-storage guard, non-deletable keep) — swizzles `restartAuthentication:` via `method_exchangeImplementations` (mirrors `SFSDKLogoutBlocker.swift`), snapshots the now-`internal` `loginHostList` for the empty-storage case, and attaches the running app's `UIScene` to the request (the migrated `showErrorAlert` skips presentation on nil scene, unlike upstream ObjC — this is why the first test run timed out; fix = set `request.scene`); wired into pbxproj as **Swift** (2 fresh IDs `E40A1C01/02…`), NOT ObjC. `NewLoginHostTests.swift` +6 validation tests (verbatim, matched pre-image). SDKCore/SmartStore/MobileSync TEST BUILD ✓ (0 errors, 0 new warnings in diff); 19 SDKCore tests PASS (10 NewLoginHost + 9 recovery, fixture-based/not live-gated). ⚠ escalation: login-UI + login-host recovery behavior + L10n — flag in PR. |
 | 41 | #4095 token-exchange error tests | e4bdf6397 | A | — | ✅ ported fd0fde64acb2d2a1ba828deffa7262a5449facfd | OAuth2 token-endpoint error classification tests. NEW **SFSDKOAuth2TokenExchangeErrorTests.swift** (7 tests: invalid_grant family ×3 descriptions, invalid_client_id, invalid_client, unsupported_grant_type, invalid_request, enum-mapping lock-in for the 5 wire values, success-response control) ported byte-faithful except two migration adaptations forced by the unit-38 Swift port: (1) `SFSDKOAuthTokenEndpointErrorResponse.errorCode` is the **typed `SFOAuthErrorCode` enum** in the Swift twin (was `NSInteger` in ObjC), so the assertion compares enum-to-enum (`expectedEnum`) instead of `expectedEnum.rawValue`; (2) the Swift `SFSDKOAuthTokenEndpointResponse(dictionary:parseAdditionalFields:)` init is **non-failable** and takes **`NSDictionary`** (was an implicitly-optional ObjC init), so call sites bind directly (no `guard let`) with `let params: NSDictionary`. Wired into SDKCore-test pbxproj as Swift (2 fresh IDs `E40A1C03/04…`). Test-only, SDKCore-scoped — no production change. SDKCore TEST BUILD ✓ (0 errors, 0 new warnings); 7 tests PASS. No escalation. |
 | 42 | #4096 SQLCipher 4.17.0 | 303013dd7 | C | ⚠⚠ dependency bump (PRE-APPROVED gate) | ✅ ported 2e54cc1c8d37293aa0514f9d9fda7fd101e06df8 | SQLCipher **4.16.0 → 4.17.0** (SQLite 3.53.1 → **3.53.3** runtime). Mechanical version bump across 7 files: **SmartStore.podspec** (`smartstore.dependency 'SQLCipher', '~> 4.17.0'`), **mobilesdk_pods.rb** (`pod 'SQLCipher', '4.17.0'`), **SmartStore pbxproj** + **MobileSyncExplorer pbxproj** (SPM `XCRemoteSwiftPackageReference` exactVersion `4.17.0`, tab-indented, single occurrence each, `plutil` clean), **SFSmartStoreTests.swift** (the COMPILED twin — `testSqliteVersion` `3.53.3`, `testSqlCipherVersion` `4.17.0 community`) + de-ref **SFSmartStoreTests.m** ref-synced verbatim (`.m` is 0-in-Sources; `.swift` twin at pbxproj line 856 is compiled), **`.claude/skills/update-sqlcipher/SKILL.md`** (byte-identical to upstream post-image `79b7335f`: `SQLLite`→`SQLite` typo + example-placeholder assert → `NEW_SQLITE_VERSION`). SPM resolved+checked-out 4.17.0; a stale precompiled-module cache (`sqlite3.h` changed under the version swap) forced a **full Build-dir wipe** (SourcePackages retained) — clean rebuild GREEN. SmartStore + MobileSync (top-of-chain) TEST BUILD ✓ 0 errors; 3 version tests PASS (runtime confirmed `4.17.0 community` / SQLite `3.53.3`). ⚠⚠ dependency bump — PRE-APPROVED (Feedback #4), still flag in PR. |
-| 43 | #4098 fix nil-sceneId crash on advanced-auth browser callback | e4e838863 | B | ⚠ OAuth/scene | ⬜ pending | `SFOAuthCoordinator+Internal.h/.m`, `SFSDKAuthSession.m` + test. |
+| 43 | #4098 fix nil-sceneId crash on advanced-auth browser callback | e4e838863 | B | ⚠ OAuth/scene | ✅ ported acf8ccf568316871a03b2a026ffa7f6816b709f6 | Advanced-auth (ASWebAuthenticationSession) browser callback crashed when the login started before any UIScene connected: `sceneId` was nil (`persistentIdentifier` nil pre-scene / weak authSession dealloc'd) and got inserted into the callback options dict. Ported into compiled Swift twins: **SFSDKAuthSession.swift** (new `static let unscopedSceneIdPrefix`; init synthesizes a unique per-session id `"<prefix><UUID>"` when `request.scene?.session.persistentIdentifier` is nil — **also fixes a latent collision the migration had**: migrated `sceneId` was a non-optional `String` defaulting to `""`, so all scene-less sessions previously shared one `authSessions[]` key), **SFOAuthCoordinator.swift** (new `browserCallbackOptions(forSceneId:) -> [AnyHashable:Any]` returns `[:]` on nil else `[UserAccountManager.IDPSceneKey: sceneId]`; callback now calls it — no more empty-string key). Helper is `internal` → visible to `@testable` (no new public API; upstream declared it in `SFOAuthCoordinator+Internal.h`). De-ref ref-sync (byte-faithful to upstream post-image, matched pre-image): `SFSDKAuthSession.m` (prefix const + synthesized `_sceneId`), `SFOAuthCoordinator.m` (`browserCallbackOptionsForSceneId:` + call site). Tombstone SKIP: `SFOAuthCoordinator+Internal.h` (migration tombstone, no `@interface` region — the Swift class holds the real decl). Tests: de-ref `SFOAuthCoordinatorTests.m` +74 ref-synced verbatim (region byte-identical to upstream), AND the 4 tests ported to the compiled Swift twin `SFOAuthCoordinatorTests.swift` (adapted to Swift surface: `SFSDKAuthSession(with:credentials:)`, `SFOAuthCoordinator(authSession:)`, `UserAccountManager.IDPSceneKey`, `sceneId.isEmpty`/`hasPrefix` since non-optional String). SDKCore/SmartStore/MobileSync TEST BUILD ✓ (0 errors, 0 NEW warnings — 2 pre-existing unrelated warnings confirmed unchanged); 6 SFOAuthCoordinatorTests PASS (4 new + 2 existing, not live-gated). ⚠ escalation: OAuth/scene callback behavior — flag in PR. |
 | 44 | #4087 token refresh coordinator | 6e0967833 | B+D | ⚠⚠⚠ OAuth/token (LIVE-AUTH UNBLOCKER) | ⬜ pending | 18 files: NEW `SFSDKTokenRefreshCoordinator.h/.m`, `SFOAuthErrorCode.swift`(via #4094), `SFOAuthSessionRefresher.*`, `SFIdentityCoordinator.m`, `SFRestAPI.m`, `UserAccountManager.swift`, `SFSDKOAuth2.m` + tests. **THIS unblocks the 51 SKIP-gated live-org tests → enables Phase 2.** |
 | 45 | #4102 improve token-refresh error handling | 19d4436ab | B | ⚠ OAuth/token | ⬜ pending | `SFRestAPI.m`, `SFSDKOAuth2.h/.m` + tests + pbxproj. |
 | 46 | #4105 fix iOS26 login-host classifier | b155f785d | B | ⚠ login-host | ⬜ pending | `SFOAuthCoordinator.m`, `SFSDKAuthErrorManager.m/+Internal.h` + test + pbxproj. |

.claude/upstream-sync-marker

@@ -1 +1 @@
-303013dd7d3a05234559947ab188c6647c26c296
+e4e8388636da5c6f993c8bfeb68214d7f74bb331

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/OAuth/SFOAuthCoordinator.m

@@ -435,7 +435,7 @@ - (void)continueNativeBrowserFlowWithSharedBrowserSessionEnabled:(BOOL)shareBrow
     _asWebAuthenticationSession = [[ASWebAuthenticationSession alloc] initWithURL:nativeBrowserUrl callbackURLScheme:[NSURL URLWithString:self.credentials.redirectUri].scheme completionHandler:^(NSURL *callbackURL, NSError *error) {
         __strong typeof(weakSelf) strongSelf = weakSelf;
         if (!error && [[SFSDKURLHandlerManager sharedInstance] canHandleRequest:callbackURL options:nil]) {
-            NSDictionary *options = @{kSFIDPSceneIdKey : self.authSession.sceneId};
+            NSDictionary *options = [self browserCallbackOptionsForSceneId:self.authSession.sceneId];
             [[SFSDKURLHandlerManager sharedInstance] processRequest:callbackURL options:options completion:nil failure:nil];
         } else {
             [strongSelf.delegate oauthCoordinatorDidCancelBrowserAuthentication:strongSelf];
@@ -445,6 +445,13 @@ - (void)continueNativeBrowserFlowWithSharedBrowserSessionEnabled:(BOOL)shareBrow
     [self.delegate oauthCoordinator:self didBeginAuthenticationWithSession:_asWebAuthenticationSession];
 }
 
+- (NSDictionary *)browserCallbackOptionsForSceneId:(nullable NSString *)sceneId {
+    // Guard against a nil sceneId so we never insert nil into the options dictionary; omit the
+    // key and let the URL handler fall back to the default scene. sceneId can be nil if the weak
+    // authSession has deallocated by the time the browser callback fires.
+    return sceneId ? @{kSFIDPSceneIdKey : sceneId} : @{};
+}
+
 - (void)beginWebViewFlow {
     if (![NSThread isMainThread]) {
         dispatch_async(dispatch_get_main_queue(), ^{

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/OAuth/SFOAuthCoordinator.swift

@@ -423,7 +423,7 @@ public class SFOAuthCoordinator: NSObject, WKNavigationDelegate, WKUIDelegate {
         _asWebAuthenticationSession = ASWebAuthenticationSession(url: nativeBrowserUrl, callbackURLScheme: redirectScheme) { [weak self] callbackURL, error in
             guard let self = self else { return }
             if error == nil, let url = callbackURL, SFSDKURLHandlerManager.sharedInstance.canHandleRequest(url, options: nil) {
-                let options: [AnyHashable: Any] = [UserAccountManager.IDPSceneKey: self.authSession?.sceneId ?? ""]
+                let options = self.browserCallbackOptions(forSceneId: self.authSession?.sceneId)
                 SFSDKURLHandlerManager.sharedInstance.processRequest(url, options: options, completion: nil, failure: nil)
             } else {
                 self.delegate?.oauthCoordinatorDidCancelBrowserAuthentication(self)
@@ -435,6 +435,18 @@ public class SFOAuthCoordinator: NSObject, WKNavigationDelegate, WKUIDelegate {
         }
     }
 
+    /// Builds the options dictionary handed to the URL handler on the advanced-auth browser callback.
+    /// Guards against a nil sceneId so nil is never inserted into the dictionary.
+    /// - Parameter sceneId: The auth session's scene id, or nil if no scene was connected / the session deallocated.
+    /// - Returns: A dictionary keyed by `UserAccountManager.IDPSceneKey` when sceneId is non-nil, or an empty dictionary otherwise.
+    func browserCallbackOptions(forSceneId sceneId: String?) -> [AnyHashable: Any] {
+        // Guard against a nil sceneId so we never insert nil into the options dictionary; omit the
+        // key and let the URL handler fall back to the default scene. sceneId can be nil if the weak
+        // authSession has deallocated by the time the browser callback fires.
+        guard let sceneId else { return [:] }
+        return [UserAccountManager.IDPSceneKey: sceneId]
+    }
+
     func beginWebViewFlow() {
         guard Thread.isMainThread else {
             DispatchQueue.main.async { [weak self] in

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/OAuth/SFSDKAuthSession.m

@@ -29,6 +29,9 @@
 #import "SFOAuthCoordinator+Internal.h"
 #import "SFIdentityCoordinator.h"
 
+// Prefix for the synthesized scene id used when a login starts before any UIScene has connected.
+static NSString * const kSFSDKAuthSessionUnscopedSceneIdPrefix = @"com.salesforce.mobilesdk.unscopedAuthSession-";
+
 @interface SFSDKAuthSession()
 @end
 
@@ -47,7 +50,9 @@ -(instancetype)initWith:(SFSDKAuthRequest *)request credentials:(SFOAuthCredenti
         _credentials = (creds == nil) ? [self newClientCredentials] : creds;
         _credentials.jwt = request.jwtToken;
         _spAppCredentials = spAppCredentials;
-        _sceneId = request.scene.session.persistentIdentifier; // Pass through for convenience
+        // When no scene is connected yet, persistentIdentifier is nil; synthesize a unique per-session id
+        // so this session gets its own authSessions[] key and the browser callback can key back to it.
+        _sceneId = request.scene.session.persistentIdentifier ?: [kSFSDKAuthSessionUnscopedSceneIdPrefix stringByAppendingString:[[NSUUID UUID] UUIDString]];
         [self initCoordinator];
     }
     return self;

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/OAuth/SFSDKAuthSession.swift

@@ -25,6 +25,9 @@ import Foundation
 @objcMembers
 public class SFSDKAuthSession: NSObject {
 
+    // Prefix for the synthesized scene id used when a login starts before any UIScene has connected.
+    static let unscopedSceneIdPrefix = "com.salesforce.mobilesdk.unscopedAuthSession-"
+
     public var isAuthenticating: Bool = false
     public var credentials: OAuthCredentials
     public var oauthCoordinator: SFOAuthCoordinator
@@ -52,7 +55,9 @@ public class SFSDKAuthSession: NSObject {
         resolvedCredentials.setValue(request.jwtToken, forKey: "jwt")
         self.credentials = resolvedCredentials
         self.spAppCredentials = spAppCredentials
-        self.sceneId = request.scene?.session.persistentIdentifier ?? ""
+        // When no scene is connected yet, persistentIdentifier is nil; synthesize a unique per-session id
+        // so this session gets its own authSessions[] key and the browser callback can key back to it.
+        self.sceneId = request.scene?.session.persistentIdentifier ?? "\(SFSDKAuthSession.unscopedSceneIdPrefix)\(UUID().uuidString)"
 
         // Temp init — coordinator requires self
         self.oauthCoordinator = SFOAuthCoordinator(credentials: resolvedCredentials)