fix(dpop): gate proof attachment on per-credential state

DPoP proof attachment was gated by the process-wide
`SalesforceSDKManager.isUseDPoP()` flag. When the flag was flipped off while a
DPoP-bound credential was still in use, subsequent refresh calls and REST /
identity requests silently dropped the proof, producing a 401 loop.

Gate on `tokenType == "DPoP"` OR `DPoPKeyManager.hasKeyPair(alias)` instead.
The global flag continues to govern new logins only; once a credential is
bound, every request for it carries a proof regardless of flag state.

- DPoPKeyManager: add `hasKeyPair(alias)` side-effect-free presence check;
  add `shouldAttachDPoP(alias, tokenType)` belt-and-suspenders predicate.
- OAuth2: widen `refreshAuthToken` with `tokenType`; replace flag guards at
  refresh, use_dpop_nonce retry, and identity-service paths with the new
  predicate.
- RestClient / ClientManager / AuthenticatorService: thread `tokenType`
  through so the outbound-API guard honors bound credentials.
- Tests: OAuth2DPoPTest + RestClientDPoPGateTests unit coverage;
  DPoPKeyManagerTest coverage for the presence check; AuthFlowTester UI test
  locks in the flag-off-then-refresh behavior.

Author: sfdctaka

libs/SalesforceSDK/src/com/salesforce/androidsdk/auth/AuthenticatorService.java

@@ -140,7 +140,7 @@ public Bundle getAuthToken(AccountAuthenticatorResponse response, Account accoun
                 SalesforceSDKLogger.i(TAG, "Initiating token refresh to host: " + tokenServer.getHost());
                 final OAuth2.TokenEndpointResponse tr = OAuth2.refreshAuthToken(HttpAccess.DEFAULT,
                         tokenServer, originalUserAccount.getClientIdForRefresh(), originalUserAccount.getRefreshToken(), addlParamsMap,
-                        originalUserAccount.getCredentialsIdentifier());
+                        originalUserAccount.getCredentialsIdentifier(), originalUserAccount.getTokenType());
 
                 UserAccount updatedUserAccount = UserAccountBuilder.getInstance()
                         .populateFromUserAccount(originalUserAccount)

libs/SalesforceSDK/src/com/salesforce/androidsdk/auth/OAuth2.java

@@ -497,7 +497,8 @@ public static TokenEndpointResponse refreshAuthToken(HttpAccess httpAccessor, UR
 
     /**
      * Gets a new auth token using the refresh token. Overload that accepts a
-     * credentials identifier so DPoP proof can be attached when enabled.
+     * credentials identifier so DPoP proof can be attached when enabled. Delegates
+     * to the fully-parameterized overload with a null token type.
      *
      * @param httpAccessor HttpAccess instance.
      * @param loginServer Login server.
@@ -515,6 +516,34 @@ public static TokenEndpointResponse refreshAuthToken(HttpAccess httpAccessor, UR
                                                          Map<String,String> addlParams,
                                                          @Nullable String credentialsIdentifier)
             throws OAuthFailedException, IOException {
+        return refreshAuthToken(httpAccessor, loginServer, clientId, refreshToken, addlParams,
+                credentialsIdentifier, null);
+    }
+
+    /**
+     * Gets a new auth token using the refresh token. Fully-parameterized overload
+     * that accepts the credential's persisted token type. When the credential is
+     * DPoP-bound the refresh request carries a DPoP proof — independent of the
+     * global {@code isUseDPoP} switch, which only gates new logins.
+     *
+     * @param httpAccessor HttpAccess instance.
+     * @param loginServer Login server.
+     * @param clientId Client ID.
+     * @param refreshToken Refresh token.
+     * @param addlParams Additional parameters.
+     * @param credentialsIdentifier Identifier used to look up the DPoP keypair, or null.
+     * @param tokenType Token type persisted on the credential (e.g. "DPoP" or null / "Bearer").
+     * @return Token response.
+     *
+     * @throws OAuthFailedException See {@link OAuthFailedException}.
+     * @throws IOException See {@link IOException}.
+     */
+    public static TokenEndpointResponse refreshAuthToken(HttpAccess httpAccessor, URI loginServer,
+                                                         String clientId, String refreshToken,
+                                                         Map<String,String> addlParams,
+                                                         @Nullable String credentialsIdentifier,
+                                                         @Nullable String tokenType)
+            throws OAuthFailedException, IOException {
         final FormBody.Builder builder = new FormBody.Builder();
         final boolean useHybridAuthentication = SalesforceSDKManager.getInstance().shouldUseHybridAuthentication();
         final String grantType = useHybridAuthentication ? HYBRID_REFRESH : REFRESH_TOKEN;
@@ -530,7 +559,7 @@ public static TokenEndpointResponse refreshAuthToken(HttpAccess httpAccessor, UR
                 }
             }
         }
-        return makeTokenEndpointRequest(httpAccessor, loginServer, builder, SalesforceSDKManager.getInstance(), credentialsIdentifier);
+        return makeTokenEndpointRequest(httpAccessor, loginServer, builder, SalesforceSDKManager.getInstance(), credentialsIdentifier, tokenType);
     }
 
     /**
@@ -619,7 +648,7 @@ public static IdServiceResponse callIdentityService(HttpAccess httpAccessor,
             throws IOException {
         final Request.Builder builder = new Request.Builder().url(identityServiceIdUrl).get();
         addAuthorizationHeader(builder, authToken, tokenType);
-        if (DPOP.equals(tokenType) && credentialsIdentifier != null && SalesforceSDKManager.getInstance().isUseDPoP()) {
+        if (DPoPKeyManager.INSTANCE.shouldAttachDPoP(credentialsIdentifier, tokenType)) {
             try {
                 final String htu = DPoPURLHelper.INSTANCE.canonicalize(identityServiceIdUrl);
                 final String alias = DPoPKeyManager.INSTANCE.aliasForCredentialsIdentifier(credentialsIdentifier);
@@ -671,7 +700,7 @@ public static TokenEndpointResponse makeTokenEndpointRequest(HttpAccess httpAcce
                                                                  FormBody.Builder formBodyBuilder,
                                                                  SalesforceSDKManager salesforceSdkManager)
             throws OAuthFailedException, IOException {
-        return makeTokenEndpointRequest(httpAccessor, loginServer, formBodyBuilder, salesforceSdkManager, null);
+        return makeTokenEndpointRequest(httpAccessor, loginServer, formBodyBuilder, salesforceSdkManager, null, null);
     }
 
     @VisibleForTesting
@@ -682,6 +711,18 @@ public static TokenEndpointResponse makeTokenEndpointRequest(HttpAccess httpAcce
                                                                  SalesforceSDKManager salesforceSdkManager,
                                                                  @Nullable String credentialsIdentifier)
             throws OAuthFailedException, IOException {
+        return makeTokenEndpointRequest(httpAccessor, loginServer, formBodyBuilder, salesforceSdkManager, credentialsIdentifier, null);
+    }
+
+    @VisibleForTesting
+    @WorkerThread
+    public static TokenEndpointResponse makeTokenEndpointRequest(HttpAccess httpAccessor,
+                                                                 URI loginServer,
+                                                                 FormBody.Builder formBodyBuilder,
+                                                                 SalesforceSDKManager salesforceSdkManager,
+                                                                 @Nullable String credentialsIdentifier,
+                                                                 @Nullable String tokenType)
+            throws OAuthFailedException, IOException {
 
         final StringBuilder sb = new StringBuilder(loginServer.toString());
         sb.append(OAUTH_TOKEN_PATH);
@@ -703,8 +744,9 @@ public static TokenEndpointResponse makeTokenEndpointRequest(HttpAccess httpAcce
         final String tokenHost = HttpUrl.get(refreshPath).host();
         final RequestBody body = formBodyBuilder.build();
         final Request.Builder requestBuilder = new Request.Builder().url(refreshPath).post(body);
+        final boolean attachDPoP = DPoPKeyManager.INSTANCE.shouldAttachDPoP(credentialsIdentifier, tokenType);
 
-        if (credentialsIdentifier != null && salesforceSdkManager.isUseDPoP()) {
+        if (attachDPoP) {
             try {
                 final String htu = DPoPURLHelper.INSTANCE.canonicalize(refreshPath);
                 final String alias = DPoPKeyManager.INSTANCE.aliasForCredentialsIdentifier(credentialsIdentifier);
@@ -721,16 +763,15 @@ public static TokenEndpointResponse makeTokenEndpointRequest(HttpAccess httpAcce
         Response response = httpAccessor.getOkHttpClient().newCall(request).execute();
 
         // Harvest nonce from every response (proactive caching for next call).
-        if (credentialsIdentifier != null && salesforceSdkManager.isUseDPoP()) {
+        if (attachDPoP) {
             final String responseNonce = response.header("DPoP-Nonce");
             if (!TextUtils.isEmpty(responseNonce)) {
                 DPoPNonceCache.INSTANCE.store(credentialsIdentifier, tokenHost, responseNonce);
             }
         }
 
         // Nonce challenge: server requires a nonce. Retry once with the harvested nonce.
-        if (credentialsIdentifier != null && salesforceSdkManager.isUseDPoP()
-                && isNonceChallenge(response)) {
+        if (attachDPoP && isNonceChallenge(response)) {
             response.close();
             try {
                 final String htu = DPoPURLHelper.INSTANCE.canonicalize(refreshPath);

libs/SalesforceSDK/src/com/salesforce/androidsdk/auth/dpop/DPoPKeyManager.kt

@@ -38,6 +38,7 @@ import java.security.spec.ECGenParameterSpec
 object DPoPKeyManager {
 
     private const val ANDROID_KEYSTORE = "AndroidKeyStore"
+    private const val DPOP_TOKEN_TYPE = "DPoP"
 
     fun generateOrLoadKeyPair(alias: String): KeyPair {
         val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) }
@@ -69,4 +70,38 @@ object DPoPKeyManager {
     }
 
     fun aliasForCredentialsIdentifier(id: String): String = "dpop_$id"
+
+    /**
+     * Returns true iff a key pair is already present in the AndroidKeyStore for the given alias.
+     * Side-effect-free — does NOT mint a key pair on miss.
+     */
+    fun hasKeyPair(alias: String): Boolean {
+        if (alias.isEmpty()) return false
+        return try {
+            val keyStore = KeyStore.getInstance(ANDROID_KEYSTORE).apply { load(null) }
+            keyStore.containsAlias(alias)
+        } catch (e: Exception) {
+            false
+        }
+    }
+
+    /** Convenience overload — computes the alias for `credentialsIdentifier` and calls `hasKeyPair`. */
+    fun hasKeyPairForCredentialsIdentifier(credentialsIdentifier: String?): Boolean {
+        if (credentialsIdentifier.isNullOrEmpty()) return false
+        return hasKeyPair(aliasForCredentialsIdentifier(credentialsIdentifier))
+    }
+
+    /**
+     * Decides whether a DPoP proof should be attached to a request for a credential identified
+     * by `credentialsIdentifier`. Returns true when either the credential's tokenType is "DPoP"
+     * or a DPoP key pair has already been minted for the credential. Either signal alone is
+     * sufficient — they cover the transient window between `/authorize` (which mints the key
+     * pair before tokenType is written) and `/token` (which writes tokenType after the key pair
+     * has been used to sign the proof).
+     */
+    fun shouldAttachDPoP(credentialsIdentifier: String?, tokenType: String?): Boolean {
+        if (credentialsIdentifier.isNullOrEmpty()) return false
+        if (DPOP_TOKEN_TYPE == tokenType) return true
+        return hasKeyPairForCredentialsIdentifier(credentialsIdentifier)
+    }
 }

libs/SalesforceSDK/src/com/salesforce/androidsdk/rest/ClientManager.java

@@ -782,7 +782,7 @@ private UserAccount refreshStaleToken(Account account) throws NetworkErrorExcept
                 SalesforceSDKLogger.i(TAG, "Initiating token refresh to host: " + tokenServer.getHost());
                 final TokenEndpointResponse tr = refreshAuthToken(HttpAccess.DEFAULT,
                         tokenServer, originalUserAccount.getClientIdForRefresh(), currentRefreshToken, addlParamsMap,
-                        originalUserAccount.getCredentialsIdentifier());
+                        originalUserAccount.getCredentialsIdentifier(), originalUserAccount.getTokenType());
 
                 if (tr.authToken == null) {
                     throw new MalformedTokenException("Token endpoint returned null access token");

libs/SalesforceSDK/src/com/salesforce/androidsdk/rest/RestClient.java

@@ -915,9 +915,7 @@ private Request buildAuthenticatedRequest(Request request) {
         }
 
         private void attachDPoPProofIfNeeded(Request.Builder builder, String method, String url) {
-            if (!DPOP.equals(tokenType)) return;
-            if (!SalesforceSDKManager.getInstance().isUseDPoP()) return;
-            if (credentialsIdentifier == null || credentialsIdentifier.isEmpty()) return;
+            if (!DPoPKeyManager.INSTANCE.shouldAttachDPoP(credentialsIdentifier, tokenType)) return;
             try {
                 final String htu = DPoPURLHelper.INSTANCE.canonicalize(url);
                 final String host = HttpUrl.get(url).host();