W-19758940: Improve ClientManager for multi-user (#2973)

* feat(W-19758940): bind ClientManager to persisted user

* fix(W-19758940): address Android PR review feedback

* test(W-19758940): automate multi-user refresh failures

* fix(push): log skipped deregistration work

* fix(AuthFlowTester): dismiss logout dialog on completion

Author: brandonpage

.github/workflows/reusable-ui-workflow.yaml

@@ -103,6 +103,7 @@ jobs:
             class com.salesforce.samples.authflowtester.ECALoginTests#testECAJwt_AllScopes, \
             class com.salesforce.samples.authflowtester.TokenMigrationTest#testMigrate_ECA_AddMoreScopes, \
             class com.salesforce.samples.authflowtester.MultiUserLoginTests#testSameApp_SameScopes_uniqueTokens, \
+            class com.salesforce.samples.authflowtester.MultiUserLoginTests#testRetainedUserClient_refreshesWhileOtherUserCurrent, \
             class com.salesforce.samples.authflowtester.BeaconLoginTests#testBeaconOpaque_DefaultScopes, \
             class com.salesforce.samples.authflowtester.AdvancedAuthBeaconLoginTests#testBeaconOpaque_DefaultScopes"
 

docs/auth/token-lifecycle.md

@@ -73,7 +73,7 @@ delegates to `AccMgrAuthTokenProvider.getNewAuthToken()`. That method:
    the instance URL changed), publishes the new tokens to the per-account `RefreshState`,
    and wakes waiting losers.
 
-6. On terminal failure (`invalid_grant`, `client_blocked`): broadcasts
+6. On terminal failure (`invalid_grant`, `app_attest_failed`): broadcasts
    `ACCESS_TOKEN_REVOKE_INTENT` and calls `SalesforceSDKManager.logout()`.
 
 ---

docs/push/README.md

@@ -217,7 +217,11 @@ Registration status constants (passed to `onPushNotificationRegistrationStatus`)
 
 Internal `Worker` subclass that executes push registration changes on a background thread via `WorkManager`. Not instantiated directly — use `PushService.enqueuePushNotificationsRegistrationWork(...)`.
 
-When `userAccount` is `null`, the worker iterates all authenticated users and calls `performRegistrationChange` for each.
+For registration, absent account identifiers target all authenticated users. Deregistration always
+requires an exact org and user ID. If that account no longer resolves, WorkManager records a
+non-retryable failure; best-effort server deregistration may remain incomplete until the record's
+TTL expires or a later explicit deregistration succeeds. If a resolved account cannot produce a
+REST client, the worker completes without a remote change and logs a warning.
 
 ---
 

libs/MobileSync/src/com/salesforce/androidsdk/mobilesync/manager/SyncManager.kt

@@ -46,6 +46,7 @@ import com.salesforce.androidsdk.mobilesync.util.SyncState.Status.STOPPED
 import com.salesforce.androidsdk.mobilesync.util.SyncState.Type.syncDown
 import com.salesforce.androidsdk.mobilesync.util.SyncState.Type.syncUp
 import com.salesforce.androidsdk.rest.ApiVersionStrings
+import com.salesforce.androidsdk.rest.ClientManager
 import com.salesforce.androidsdk.rest.RestClient
 import com.salesforce.androidsdk.rest.RestRequest
 import com.salesforce.androidsdk.rest.RestResponse
@@ -826,9 +827,10 @@ class SyncManager private constructor(smartStore: SmartStore, restClient: RestCl
                  * RestClient should be set to the unauthenticated RestClient instance.
                  */
                 val restClient: RestClient? = if (user == null) {
-                    SalesforceSDKManager.getInstance().clientManager.peekUnauthenticatedRestClient()
+                    SalesforceSDKManager.getInstance().getUnauthenticatedRestClient()
                 } else {
-                    SalesforceSDKManager.getInstance().clientManager.peekRestClient(user)
+                    ClientManager(SalesforceSDKManager.getInstance().appContext, user)
+                        .peekRestClient()
                 }
                 instance = SyncManager(store, restClient)
                 instance.also { INSTANCES[uniqueId] = it }
@@ -874,4 +876,4 @@ class SyncManager private constructor(smartStore: SmartStore, restClient: RestCl
             }
         }
     }
-}
+}

libs/SalesforceHybrid/src/com/salesforce/androidsdk/phonegap/plugin/SFAccountManagerPlugin.java

@@ -29,6 +29,7 @@
 import android.content.Intent;
 
 import com.salesforce.androidsdk.accounts.UserAccount;
+import com.salesforce.androidsdk.accounts.UserAccountManager;
 import com.salesforce.androidsdk.app.SalesforceSDKManager;
 import com.salesforce.androidsdk.phonegap.util.SalesforceHybridLogger;
 
@@ -133,7 +134,13 @@ protected void logout(JSONArray args, CallbackContext callbackContext) {
         		account = new UserAccount(user);
         	}
         }
-        SalesforceSDKManager.getInstance().getUserAccountManager().signoutUser(account, cordova.getActivity());
+        final UserAccountManager userAccountManager =
+                SalesforceSDKManager.getInstance().getUserAccountManager();
+        if (account == null) {
+            userAccountManager.signoutCurrentUser(cordova.getActivity());
+        } else {
+            userAccountManager.signoutUser(account, cordova.getActivity());
+        }
         callbackContext.success();
     }
 

libs/SalesforceHybrid/src/com/salesforce/androidsdk/phonegap/plugin/SalesforceNetworkPlugin.java

@@ -29,6 +29,7 @@
 import android.text.TextUtils;
 import android.util.Base64;
 
+import com.salesforce.androidsdk.app.SalesforceSDKManager;
 import com.salesforce.androidsdk.phonegap.ui.SalesforceDroidGapActivity;
 import com.salesforce.androidsdk.phonegap.util.SalesforceHybridLogger;
 import com.salesforce.androidsdk.rest.RestClient;
@@ -270,7 +271,7 @@ private RestClient getRestClient(boolean doesNotRequireAuth) {
             return null;
         }
         if (doesNotRequireAuth) {
-            return currentActivity.buildClientManager().peekUnauthenticatedRestClient();
+            return SalesforceSDKManager.getInstance().getUnauthenticatedRestClient();
         }
         return currentActivity.getRestClient();
     }