fix(telemetry): correct L3/L4 layout and remove B2 (MDM) from Android selection

- L3 is now FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY (welcome.salesforce.com via WD flag)
- L4 is now FEATURE_LOGIN_SERVER_MY_DOMAIN (host ending in .my.salesforce.com)
- L5 remains the custom/fallthrough bucket
- My Domain detection now uses `.my.salesforce.com` host suffix instead of isPoolServer guard
- B2 (FEATURE_BROWSER_LOGIN_MDM) stays defined in Features.java for future use
  but is never selected on Android — MDM on Android forces cert auth (different code
  path that never sets completedViaBrowserTab); isMdmForcedBrowserLogin() is kept
  with an explanatory comment pending a real signal
- Android B-marker priority is now: B3 (admin) > B4 (force flag) > B1 (server auth config)
- Tests updated accordingly (B2 test expects B1 fallthrough; L3/L4 tests use new mapping)

Part of W-23240736

Author: wmathurin

libs/SalesforceSDK/src/com/salesforce/androidsdk/app/Features.java

@@ -57,7 +57,7 @@ public class Features {
     // "Which login server type" — registered per-user on every auth-flow completion
     public static final String FEATURE_LOGIN_SERVER_PRODUCTION         = "L1";
     public static final String FEATURE_LOGIN_SERVER_SANDBOX            = "L2";
-    public static final String FEATURE_LOGIN_SERVER_MY_DOMAIN          = "L3";
-    public static final String FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY  = "L4";
+    public static final String FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY  = "L3";
+    public static final String FEATURE_LOGIN_SERVER_MY_DOMAIN          = "L4";
     public static final String FEATURE_LOGIN_SERVER_CUSTOM             = "L5";
 }

libs/SalesforceSDK/src/com/salesforce/androidsdk/ui/LoginActivity.kt

@@ -643,42 +643,47 @@ open class LoginActivity : FragmentActivity() {
      */
     @VisibleForTesting
     internal fun selectLMarker(usedWelcomeDiscovery: Boolean, loginServerUrl: String): String = when {
-        usedWelcomeDiscovery -> FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY
-        LoginServerManager.PRODUCTION_LOGIN_URL == loginServerUrl -> FEATURE_LOGIN_SERVER_PRODUCTION
-        LoginServerManager.SANDBOX_LOGIN_URL == loginServerUrl -> FEATURE_LOGIN_SERVER_SANDBOX
-        !LoginServerManager.isPoolServer(loginServerUrl) &&
-            loginServerUrl != LoginServerManager.WELCOME_LOGIN_URL -> FEATURE_LOGIN_SERVER_MY_DOMAIN
-        else -> FEATURE_LOGIN_SERVER_CUSTOM
+        usedWelcomeDiscovery -> FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY                          // L3
+        LoginServerManager.PRODUCTION_LOGIN_URL == loginServerUrl -> FEATURE_LOGIN_SERVER_PRODUCTION  // L1
+        LoginServerManager.SANDBOX_LOGIN_URL == loginServerUrl -> FEATURE_LOGIN_SERVER_SANDBOX  // L2
+        loginServerUrl.toUri().host?.endsWith(".my.salesforce.com") == true -> FEATURE_LOGIN_SERVER_MY_DOMAIN  // L4
+        else -> FEATURE_LOGIN_SERVER_CUSTOM                                                     // L5
     }
 
     /**
      * Selects the B-marker (browser login reason) for telemetry.
-     * Returns exactly one of B1–B4 if browser login was used, or null if it was not.
-     * Priority: B3 (admin) > B2 (MDM) > B4 (force flag) > B1 (server auth config)
+     * Returns exactly one of B1, B3, or B4 if browser login was used, or null if it was not.
+     * Priority: B3 (admin) > B4 (force flag) > B1 (server auth config)
+     *
+     * Note: B2 (MDM) is defined in [Features] but is never selected on Android. On Android,
+     * MDM forces cert auth via a different code path that never sets [completedViaBrowserTab].
      *
      * @param completedViaBrowserTab Whether login completed via browser Custom Tab
      * @param completedViaAdminCustomTab Whether login completed via the "Login for Admin" Custom Tab
-     * @param isMdmForced Whether MDM policy forced browser login
+     * @param isMdmForced Unused on Android — reserved for future use (always pass false)
      * @param forceAdvancedAuth Whether the [SalesforceSDKManager.forceAdvancedAuthentication] flag is set
      * @return The B-marker feature code to register, or null if browser login was not used
      */
     @VisibleForTesting
     internal fun selectBMarker(
         completedViaBrowserTab: Boolean,
         completedViaAdminCustomTab: Boolean,
-        isMdmForced: Boolean,
+        @Suppress("UNUSED_PARAMETER") isMdmForced: Boolean,
         forceAdvancedAuth: Boolean,
     ): String? = when {
         !completedViaBrowserTab -> null
         completedViaAdminCustomTab -> FEATURE_BROWSER_LOGIN_FOR_ADMIN   // B3
-        isMdmForced -> FEATURE_BROWSER_LOGIN_MDM                        // B2
         forceAdvancedAuth -> FEATURE_BROWSER_LOGIN_FORCE_FLAG           // B4
         else -> FEATURE_BROWSER_LOGIN_SERVER_AUTH_CONFIG                // B1 fallthrough
     }
 
     /**
-     * Returns true when MDM policy has forced browser login.
-     * MDM registers the global [Features.FEATURE_MDM] flag via [RuntimeConfig].
+     * Reserved for future use — currently unused on Android.
+     *
+     * On Android, MDM forces cert-auth (a different code path that never sets
+     * [completedViaBrowserTab]), so [Features.FEATURE_BROWSER_LOGIN_MDM] (B2) is never
+     * selected. This helper is retained so the call site in [onAuthFlowSuccess] remains
+     * forward-compatible once a real Android MDM-browser-login signal is identified.
      */
     private fun isMdmForcedBrowserLogin(): Boolean =
         SalesforceSDKManager.getInstance().isGlobalFeatureRegistered(

libs/test/SalesforceSDKTest/src/com/salesforce/androidsdk/app/BrowserLoginTelemetryTest.kt

@@ -30,7 +30,6 @@ import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.filters.SmallTest
 import com.salesforce.androidsdk.app.Features.FEATURE_BROWSER_LOGIN_FOR_ADMIN
 import com.salesforce.androidsdk.app.Features.FEATURE_BROWSER_LOGIN_FORCE_FLAG
-import com.salesforce.androidsdk.app.Features.FEATURE_BROWSER_LOGIN_MDM
 import com.salesforce.androidsdk.app.Features.FEATURE_BROWSER_LOGIN_SERVER_AUTH_CONFIG
 import com.salesforce.androidsdk.app.Features.FEATURE_LOGIN_SERVER_CUSTOM
 import com.salesforce.androidsdk.app.Features.FEATURE_LOGIN_SERVER_MY_DOMAIN
@@ -56,6 +55,19 @@ import org.junit.runner.RunWith
  * which are `internal` helpers extracted for testability and annotated `@VisibleForTesting`.
  * We call them via a relaxed mockk and `callOriginal()` so the real logic executes without
  * needing a running Android Activity context.
+ *
+ * L-marker mapping:
+ *   L1 = Production server
+ *   L2 = Sandbox server
+ *   L3 = welcome.salesforce.com (Welcome Discovery flow)
+ *   L4 = My Domain (host ending in .my.salesforce.com)
+ *   L5 = Everything else (custom)
+ *
+ * B-marker mapping (Android):
+ *   B1 = Server auth config (fallthrough)
+ *   B2 = MDM — defined but never selected on Android (MDM forces cert auth, a different path)
+ *   B3 = Admin Custom Tab
+ *   B4 = Force-advanced-auth flag
  */
 @RunWith(AndroidJUnit4::class)
 @SmallTest
@@ -88,7 +100,7 @@ class BrowserLoginTelemetryTest {
     fun test_givenBrowserLoginViaServerAuthConfig_whenSelectBMarker_thenB1Returned() {
         every { activity.selectBMarker(any(), any(), any(), any()) } answers { callOriginal() }
 
-        // B1: browser tab, not admin, not MDM, not force-flag
+        // B1: browser tab, not admin, not force-flag (MDM ignored on Android)
         val result = activity.selectBMarker(
             completedViaBrowserTab = true,
             completedViaAdminCustomTab = false,
@@ -100,18 +112,20 @@ class BrowserLoginTelemetryTest {
     }
 
     @Test
-    fun test_givenBrowserLoginViaMDM_whenSelectBMarker_thenB2Returned() {
+    fun test_givenBrowserLoginViaMDM_whenSelectBMarker_thenB1ReturnedNotB2() {
         every { activity.selectBMarker(any(), any(), any(), any()) } answers { callOriginal() }
 
-        // B2: browser tab, not admin, MDM forced
+        // On Android, MDM forces cert auth (different code path — completedViaBrowserTab never
+        // becomes true in that flow). When isMdmForced=true is passed, it is ignored and B1
+        // is returned as the fallthrough because no real Android MDM-browser-login signal exists.
         val result = activity.selectBMarker(
             completedViaBrowserTab = true,
             completedViaAdminCustomTab = false,
             isMdmForced = true,
             forceAdvancedAuth = false,
         )
-        assertEquals("MDM-forced browser login should yield B2",
-            FEATURE_BROWSER_LOGIN_MDM, result)
+        assertEquals("MDM flag is ignored on Android; should fall through to B1",
+            FEATURE_BROWSER_LOGIN_SERVER_AUTH_CONFIG, result)
     }
 
     @Test
@@ -133,7 +147,7 @@ class BrowserLoginTelemetryTest {
     fun test_givenBrowserLoginViaForceFlag_whenSelectBMarker_thenB4Returned() {
         every { activity.selectBMarker(any(), any(), any(), any()) } answers { callOriginal() }
 
-        // B4: browser tab, not admin, not MDM, force flag ON
+        // B4: browser tab, not admin, force flag ON
         val result = activity.selectBMarker(
             completedViaBrowserTab = true,
             completedViaAdminCustomTab = false,
@@ -145,33 +159,33 @@ class BrowserLoginTelemetryTest {
     }
 
     @Test
-    fun test_givenAdminTabAndMdmAndForceFlag_whenSelectBMarker_thenB3Wins() {
+    fun test_givenAdminTabAndForceFlag_whenSelectBMarker_thenB3Wins() {
         every { activity.selectBMarker(any(), any(), any(), any()) } answers { callOriginal() }
 
-        // Priority: B3 > B2 > B4 > B1
+        // Priority on Android: B3 > B4 > B1
         val result = activity.selectBMarker(
             completedViaBrowserTab = true,
             completedViaAdminCustomTab = true,
-            isMdmForced = true,
+            isMdmForced = false,
             forceAdvancedAuth = true,
         )
         assertEquals("Admin tab should take highest priority (B3)",
             FEATURE_BROWSER_LOGIN_FOR_ADMIN, result)
     }
 
     @Test
-    fun test_givenMdmAndForceFlag_whenSelectBMarker_thenB2Wins() {
+    fun test_givenForceFlagAndMdm_whenSelectBMarker_thenB4Wins() {
         every { activity.selectBMarker(any(), any(), any(), any()) } answers { callOriginal() }
 
-        // Priority: B2 > B4
+        // On Android MDM is ignored; force flag wins over B1 fallthrough
         val result = activity.selectBMarker(
             completedViaBrowserTab = true,
             completedViaAdminCustomTab = false,
             isMdmForced = true,
             forceAdvancedAuth = true,
         )
-        assertEquals("MDM should take priority over force flag (B2 > B4)",
-            FEATURE_BROWSER_LOGIN_MDM, result)
+        assertEquals("Force flag should win over ignored MDM signal (B4)",
+            FEATURE_BROWSER_LOGIN_FORCE_FLAG, result)
     }
 
     // endregion
@@ -202,49 +216,62 @@ class BrowserLoginTelemetryTest {
     }
 
     @Test
-    fun test_givenMyDomainServer_whenSelectLMarker_thenL3Returned() {
+    fun test_givenWelcomeDiscovery_whenSelectLMarker_thenL3Returned() {
         every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
 
-        // My Domain is a non-pool, non-WD URL
+        // L3: Welcome Discovery flow — WD flag takes precedence regardless of the resolved URL
         val result = activity.selectLMarker(
-            usedWelcomeDiscovery = false,
+            usedWelcomeDiscovery = true,
             loginServerUrl = "https://myorg.my.salesforce.com",
         )
-        assertEquals("My Domain login server should yield L3",
-            FEATURE_LOGIN_SERVER_MY_DOMAIN, result)
+        assertEquals("Welcome Discovery should yield L3",
+            FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY, result)
     }
 
     @Test
-    fun test_givenWelcomeDiscovery_whenSelectLMarker_thenL4Returned() {
+    fun test_givenWelcomeDiscoveryWithProductionUrl_whenSelectLMarker_thenL3Returned() {
         every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
 
-        // WD flag takes precedence regardless of the resolved server URL
+        // WD flag wins even when the resolved URL is production
         val result = activity.selectLMarker(
             usedWelcomeDiscovery = true,
-            loginServerUrl = "https://myorg.my.salesforce.com",
+            loginServerUrl = LoginServerManager.PRODUCTION_LOGIN_URL,
         )
-        assertEquals("Welcome Discovery should yield L4",
+        assertEquals("WD flag should override production URL and yield L3",
             FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY, result)
     }
 
     @Test
-    fun test_givenWelcomeDiscoveryWithProductionUrl_whenSelectLMarker_thenL4Returned() {
+    fun test_givenMyDomainServer_whenSelectLMarker_thenL4Returned() {
         every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
 
-        // WD flag wins even when the resolved URL is production
+        // L4: host ends with .my.salesforce.com
         val result = activity.selectLMarker(
-            usedWelcomeDiscovery = true,
-            loginServerUrl = LoginServerManager.PRODUCTION_LOGIN_URL,
+            usedWelcomeDiscovery = false,
+            loginServerUrl = "https://myorg.my.salesforce.com",
         )
-        assertEquals("WD flag should override production URL and yield L4",
-            FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY, result)
+        assertEquals("My Domain login server should yield L4",
+            FEATURE_LOGIN_SERVER_MY_DOMAIN, result)
+    }
+
+    @Test
+    fun test_givenMyDomainSandboxServer_whenSelectLMarker_thenL4Returned() {
+        every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
+
+        // Sandbox My Domain also ends with .my.salesforce.com (L4, not L2, because URL != sandbox constant)
+        val result = activity.selectLMarker(
+            usedWelcomeDiscovery = false,
+            loginServerUrl = "https://myorg.sandbox.my.salesforce.com",
+        )
+        assertEquals("My Domain sandbox server should yield L4",
+            FEATURE_LOGIN_SERVER_MY_DOMAIN, result)
     }
 
     @Test
     fun test_givenWelcomeLoginUrl_whenSelectLMarker_thenL5Returned() {
         every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
 
-        // The WD URL itself is a pool server, so when usedWelcomeDiscovery=false it falls to L5.
+        // The WD URL itself: when usedWelcomeDiscovery=false it falls to L5 (custom)
         val result = activity.selectLMarker(
             usedWelcomeDiscovery = false,
             loginServerUrl = LoginServerManager.WELCOME_LOGIN_URL,
@@ -253,15 +280,27 @@ class BrowserLoginTelemetryTest {
             FEATURE_LOGIN_SERVER_CUSTOM, result)
     }
 
+    @Test
+    fun test_givenCustomServer_whenSelectLMarker_thenL5Returned() {
+        every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
+
+        val result = activity.selectLMarker(
+            usedWelcomeDiscovery = false,
+            loginServerUrl = "https://custom.example.com",
+        )
+        assertEquals("Custom server should yield L5",
+            FEATURE_LOGIN_SERVER_CUSTOM, result)
+    }
+
     @Test
     fun test_givenExactlyOneL_whenProductionServer_thenOnlyL1Selected() {
         every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
 
         val allLMarkers = listOf(
             FEATURE_LOGIN_SERVER_PRODUCTION,
             FEATURE_LOGIN_SERVER_SANDBOX,
-            FEATURE_LOGIN_SERVER_MY_DOMAIN,
             FEATURE_LOGIN_SERVER_WELCOME_DISCOVERY,
+            FEATURE_LOGIN_SERVER_MY_DOMAIN,
             FEATURE_LOGIN_SERVER_CUSTOM,
         )
         val selected = activity.selectLMarker(
@@ -273,20 +312,5 @@ class BrowserLoginTelemetryTest {
         assertEquals("The selected marker should be L1", FEATURE_LOGIN_SERVER_PRODUCTION, selected)
     }
 
-    @Test
-    fun test_givenMyDomainWithTrailingSpace_whenSelectLMarker_thenL3Returned() {
-        every { activity.selectLMarker(any(), any()) } answers { callOriginal() }
-
-        // selectLMarker trims the URL, so trailing spaces should not affect the result.
-        // Note: the trimming is done in onAuthFlowSuccess before calling selectLMarker,
-        // but selectLMarker still receives pre-trimmed input here.
-        val result = activity.selectLMarker(
-            usedWelcomeDiscovery = false,
-            loginServerUrl = "https://myorg.my.salesforce.com",
-        )
-        assertEquals("My Domain URL should yield L3",
-            FEATURE_LOGIN_SERVER_MY_DOMAIN, result)
-    }
-
     // endregion
 }