@W-23201591: [Android] Surface RTR state in developer info screen

libs/SalesforceSDK/src/com/salesforce/androidsdk/accounts/UserAccount.java

@@ -107,6 +107,7 @@ public class UserAccount {
 	public static final String FEATURE_FLAGS = "feature_flags";
 	public static final String CREDENTIALS_IDENTIFIER = "credentialsIdentifier";
 	public static final String TOKEN_TYPE = "tokenType";
+	public static final String LAST_TOKEN_ROTATION_TIME = "lastTokenRotationTime";
 
 	private static final String TAG = "UserAccount";
 	private static final String FORWARD_SLASH = "/";
@@ -156,6 +157,7 @@ public class UserAccount {
 	private String scope;
 	private String credentialsIdentifier;
 	private String tokenType;
+	private String lastTokenRotationTime;
 	private Set<String> featureFlags = new java.util.HashSet<>();
 
 	/**
@@ -301,6 +303,7 @@ public class UserAccount {
 			scope = object.optString(SCOPE, null);
 			credentialsIdentifier = object.optString(CREDENTIALS_IDENTIFIER, null);
 			tokenType = object.optString(TOKEN_TYPE, null);
+			lastTokenRotationTime = object.optString(LAST_TOKEN_ROTATION_TIME, null);
 			additionalOauthValues = MapUtil.addJSONObjectToMap(object, additionalOauthKeys, additionalOauthValues);
 		}
 	}
@@ -360,6 +363,7 @@ public UserAccount(JSONObject object) {
 			scope = bundle.getString(SCOPE);
 			credentialsIdentifier = bundle.getString(CREDENTIALS_IDENTIFIER);
 			tokenType = bundle.getString(TOKEN_TYPE);
+			lastTokenRotationTime = bundle.getString(LAST_TOKEN_ROTATION_TIME);
 			additionalOauthValues = MapUtil.addBundleToMap(bundle, additionalOauthKeys, additionalOauthValues);
 		}
 	}
@@ -785,6 +789,29 @@ public String getTokenType() {
 	public void setTokenType(String tokenType) {
 		this.tokenType = tokenType;
 	}
+
+	/**
+	 * Returns the ISO-8601 timestamp of the last confirmed Refresh Token
+	 * Rotation (RTR) for this user, or null if the refresh token has never
+	 * been rotated.
+	 *
+	 * @return Last token rotation timestamp, or null if not yet rotated.
+	 */
+	public String getLastTokenRotationTime() {
+		return lastTokenRotationTime;
+	}
+
+	/**
+	 * Sets the ISO-8601 timestamp of the last confirmed Refresh Token
+	 * Rotation (RTR).
+	 *
+	 * @param lastTokenRotationTime ISO-8601 timestamp of the last confirmed
+	 *                              rotation.
+	 */
+	public void setLastTokenRotationTime(String lastTokenRotationTime) {
+		this.lastTokenRotationTime = lastTokenRotationTime;
+	}
+
 	/**
 	 * Returns the beacon child consumer key.
 	 *
@@ -1096,6 +1123,7 @@ JSONObject toJson(List<String> additionalOauthKeys) {
 			object.put(SCOPE, scope);
 			if (credentialsIdentifier != null) object.put(CREDENTIALS_IDENTIFIER, credentialsIdentifier);
 			if (tokenType != null) object.put(TOKEN_TYPE, tokenType);
+			if (lastTokenRotationTime != null) object.put(LAST_TOKEN_ROTATION_TIME, lastTokenRotationTime);
 			if (!featureFlags.isEmpty()) {
 				org.json.JSONArray flagsArray = new org.json.JSONArray();
 				for (String f : featureFlags) flagsArray.put(f);
@@ -1164,6 +1192,7 @@ Bundle toBundle(List<String> additionalOauthKeys) {
 		object.putString(SCOPE, scope);
 		if (credentialsIdentifier != null) object.putString(CREDENTIALS_IDENTIFIER, credentialsIdentifier);
 		if (tokenType != null) object.putString(TOKEN_TYPE, tokenType);
+		if (lastTokenRotationTime != null) object.putString(LAST_TOKEN_ROTATION_TIME, lastTokenRotationTime);
 		object = MapUtil.addMapToBundle(additionalOauthValues, additionalOauthKeys, object);
 		return object;
 	}

libs/SalesforceSDK/src/com/salesforce/androidsdk/accounts/UserAccountBuilder.kt

@@ -74,6 +74,7 @@ class UserAccountBuilder private constructor() {
     private var scope: String? = null
     private var credentialsIdentifier: String? = null
     private var tokenType: String? = null
+    private var lastTokenRotationTime: String? = null
 
     /**
      * Set fields from token end point response
@@ -181,6 +182,7 @@ class UserAccountBuilder private constructor() {
             .scope(userAccount.scope)
             .credentialsIdentifier(userAccount.credentialsIdentifier)
             .tokenType(userAccount.tokenType)
+            .lastTokenRotationTime(userAccount.lastTokenRotationTime)
     }
 
     /**
@@ -610,6 +612,18 @@ class UserAccountBuilder private constructor() {
         return if (!allowUnset && tokenType == null) this else apply { this.tokenType = tokenType }
     }
 
+    /**
+     * Sets the ISO-8601 timestamp of the last confirmed Refresh Token
+     * Rotation (RTR).
+     *
+     * @param lastTokenRotationTime ISO-8601 timestamp of the last confirmed
+     * rotation.
+     * @return Instance of this class.
+     */
+    fun lastTokenRotationTime(lastTokenRotationTime: String?): UserAccountBuilder {
+        return if (!allowUnset && lastTokenRotationTime == null) this else apply { this.lastTokenRotationTime = lastTokenRotationTime }
+    }
+
     /**
      * Builds and returns a UserAccount object.
      *
@@ -658,6 +672,7 @@ class UserAccountBuilder private constructor() {
         )
         account.credentialsIdentifier = credentialsIdentifier
         account.tokenType = tokenType
+        account.lastTokenRotationTime = lastTokenRotationTime
         return account
     }
 

libs/SalesforceSDK/src/com/salesforce/androidsdk/accounts/UserAccountManager.java

@@ -558,6 +558,7 @@ public Bundle updateAccount(Account account, UserAccount userAccount) {
 		final String scope = decryptUserData(account, AuthenticatorService.KEY_SCOPE, encryptionKey);
 		final String credentialsIdentifier = decryptUserData(account, AuthenticatorService.KEY_CREDENTIALS_IDENTIFIER, encryptionKey);
 		final String tokenType = decryptUserData(account, AuthenticatorService.KEY_TOKEN_TYPE, encryptionKey);
+		final String lastTokenRotationTime = decryptUserData(account, AuthenticatorService.KEY_LAST_TOKEN_ROTATION_TIME, encryptionKey);
 		final String featureFlagsRaw = decryptUserData(account, AuthenticatorService.KEY_FEATURE_FLAGS, encryptionKey);
 
 		Map<String, String> additionalOauthValues = null;
@@ -616,6 +617,7 @@ public Bundle updateAccount(Account account, UserAccount userAccount) {
 					.scope(scope)
 					.credentialsIdentifier(credentialsIdentifier)
 					.tokenType(tokenType)
+					.lastTokenRotationTime(lastTokenRotationTime)
 					.additionalOauthValues(additionalOauthValues)
 					.build();
 			if (!TextUtils.isEmpty(featureFlagsRaw)) {
@@ -776,6 +778,9 @@ private Bundle buildAuthBundle(UserAccount userAccount) {
 		if (userAccount.getTokenType() != null) {
 			extras.putString(AuthenticatorService.KEY_TOKEN_TYPE, SalesforceSDKManager.encrypt(userAccount.getTokenType(), encryptionKey));
 		}
+		if (userAccount.getLastTokenRotationTime() != null) {
+			extras.putString(AuthenticatorService.KEY_LAST_TOKEN_ROTATION_TIME, SalesforceSDKManager.encrypt(userAccount.getLastTokenRotationTime(), encryptionKey));
+		}
 		final Set<String> featureFlags = userAccount.getFeatureFlags();
 		if (!featureFlags.isEmpty()) {
 			extras.putString(AuthenticatorService.KEY_FEATURE_FLAGS,

libs/SalesforceSDK/src/com/salesforce/androidsdk/app/SalesforceSDKManager.kt

@@ -53,7 +53,9 @@ import android.text.TextUtils.join
 import android.view.WindowInsetsController.APPEARANCE_LIGHT_STATUS_BARS
 import android.webkit.CookieManager
 import android.webkit.URLUtil.isHttpsUrl
+import android.widget.Toast
 import androidx.annotation.VisibleForTesting
+import androidx.annotation.VisibleForTesting.Companion.PRIVATE
 import androidx.annotation.VisibleForTesting.Companion.PROTECTED
 import androidx.compose.material3.ColorScheme
 import androidx.compose.runtime.Composable
@@ -147,6 +149,7 @@ import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers.Default
 import kotlinx.coroutines.Dispatchers.Main
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import java.lang.String.CASE_INSENSITIVE_ORDER
@@ -1385,6 +1388,21 @@ open class SalesforceSDKManager protected constructor(
      */
     fun isGlobalFeatureRegistered(appFeatureCode: String) = features.contains(appFeatureCode)
 
+    /**
+     * Returns true if the feature code is registered for the given user
+     * (falling back to the current user when [user] is null). Reads the
+     * per-user feature set that backs the user agent's ftr_ token, so this
+     * reflects features such as RTR that are registered per account.
+     *
+     * @param appFeatureCode The app feature code
+     * @param user The user account, or null to use the current user
+     */
+    internal fun isUserFeatureRegistered(appFeatureCode: String, user: UserAccount? = null): Boolean {
+        val resolvedUser = user ?: userAccountManager.currentUser ?: return false
+        val key = "${resolvedUser.orgId}/${resolvedUser.userId}"
+        return perUserFeatures[key]?.contains(appFeatureCode) == true
+    }
+
     /**
      * Adds a per-user app feature code for reporting in the user agent header.
      * Falls back to the global set when user is null.
@@ -1568,11 +1586,57 @@ open class SalesforceSDKManager protected constructor(
                     })
                 }
             }
+
+            /*
+             * Debug-only helper: proactively drive the SDK's standard
+             * token-refresh path so developers can observe Refresh Token
+             * Rotation (RTR) state update in the dev info screen without
+             * waiting for the access token to expire naturally. This whole
+             * menu is only shown when isDevSupportEnabled() is true (debug
+             * builds by default).
+             */
+            actions["Force Token Refresh"] = object : DevActionHandler {
+                override fun onSelected() {
+                    val user = userAccountManager.currentUser ?: return
+                    CoroutineScope(Default).launch {
+                        val message = forceTokenRefresh(user)
+                        withContext(Main) {
+                            Toast.makeText(appContext, message, Toast.LENGTH_LONG).show()
+                        }
+                    }
+                }
+            }
         }
 
         return actions
     }
 
+    /**
+     * Drives the SDK's standard token-refresh path for [user] so developers
+     * can observe Refresh Token Rotation (RTR) state update in the dev info
+     * screen without waiting for the access token to expire naturally. Backs
+     * the debug-only "Force Token Refresh" dev action.
+     *
+     * @param user The user whose access token should be refreshed.
+     * @param restClient The REST client to refresh. Defaults to the user's
+     * client; overridable so tests can supply a mock without a network call.
+     * @return A human-readable result message suitable for a Toast. Never
+     * throws — any refresh failure is caught, logged, and returned as a
+     * message (with a null-message fallback to the exception's simple class
+     * name).
+     */
+    @VisibleForTesting(otherwise = PRIVATE)
+    internal fun forceTokenRefresh(
+        user: UserAccount,
+        restClient: RestClient = clientManager.peekRestClient(user)
+    ): String = try {
+        restClient.refreshAccessToken()
+        "Token refresh complete — check RTR section in dev info"
+    } catch (ex: Exception) {
+        e(TAG, "Force Token Refresh failed", ex)
+        "Token refresh failed: ${ex.message ?: ex.javaClass.simpleName}"
+    }
+
     /** Information to display in the developer support dialog */
     @Deprecated(
         "Will be removed in Mobile SDK 14.0, please use the new data class representation.",
@@ -1637,7 +1701,20 @@ open class SalesforceSDKManager protected constructor(
 //
 //  TODO: Replace devSupportInfo with the above implementation when devSupportInfos is removed in 14.0.
     open val devSupportInfo: DevSupportInfo
-        get() = DevSupportInfo.createFromLegacyDevInfos(devSupportInfos)
+        get() = DevSupportInfo.createFromLegacyDevInfos(devSupportInfos).apply {
+            /*
+             * Surface Refresh Token Rotation (RTR) state so developers can
+             * verify whether RTR is active for the current user's session and
+             * when the token last rotated.
+             */
+            val currentUser = userAccountManager.cachedCurrentUser
+            additionalSections.add(
+                DevSupportInfo.parseRtrSection(
+                    currentUser = currentUser,
+                    rtrActive = currentUser != null && isUserFeatureRegistered(Features.FEATURE_RTR, currentUser),
+                )
+            )
+        }
 
     /** Sends the logout completed intent */
     private fun sendLogoutCompleteIntent(logoutReason: LogoutReason, userAccount: UserAccount?) =

libs/SalesforceSDK/src/com/salesforce/androidsdk/auth/AuthenticatorService.java

@@ -93,6 +93,7 @@ public class AuthenticatorService extends Service {
     public static final String KEY_FEATURE_FLAGS = "feature_flags";
     public static final String KEY_CREDENTIALS_IDENTIFIER = "credentialsIdentifier";
     public static final String KEY_TOKEN_TYPE = "tokenType";
+    public static final String KEY_LAST_TOKEN_ROTATION_TIME = "lastTokenRotationTime";
 
     private static final String TAG = "AuthenticatorService";
 

libs/SalesforceSDK/src/com/salesforce/androidsdk/developer/support/DevSupportInfo.kt

@@ -188,6 +188,31 @@ data class DevSupportInfo(
             return "Current User" to rows
         }
 
+        /**
+         * Builds the "RTR" (Refresh Token Rotation) section for the developer
+         * info screen.
+         *
+         * @param currentUser The current user account, or null if no user is
+         * logged in.
+         * @param rtrActive True if the RTR feature flag (ftr_RT) is registered
+         * for the current user.
+         * @return An "RTR" section with "RTR Active" and "Last Rotation" rows.
+         * Per-user fields show "N/A" when there is no current user; "Last
+         * Rotation" shows "Never" until the first confirmed rotation.
+         */
+        internal fun parseRtrSection(currentUser: UserAccount?, rtrActive: Boolean) =
+            if (currentUser == null) {
+                "RTR" to listOf(
+                    "RTR Active" to "N/A",
+                    "Last Rotation" to "N/A",
+                )
+            } else {
+                "RTR" to listOf(
+                    "RTR Active" to rtrActive.toString(),
+                    "Last Rotation" to (currentUser.lastTokenRotationTime?.ifBlank { "Never" } ?: "Never"),
+                )
+            }
+
         fun parseRuntimeConfig(config: RuntimeConfig): DevInfoList {
             val values = mutableListOf(
                 "Managed App" to config.isManagedApp.toString()

libs/SalesforceSDK/src/com/salesforce/androidsdk/rest/ClientManager.java

@@ -60,6 +60,7 @@
 
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.time.Instant;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
@@ -793,15 +794,31 @@ private UserAccount refreshStaleToken(Account account) throws NetworkErrorExcept
                         .populateFromTokenEndpointResponse(tr)
                         .build();
 
+                /*
+                 * Detect server-side Refresh Token Rotation: the response
+                 * carried a refresh token that differs from this provider's
+                 * cached copy. Stamp the ISO-8601 rotation time on the account
+                 * BEFORE the primary persist below so the timestamp is written
+                 * by the authoritative updateAccount call, not as a side
+                 * effect of feature-flag registration.
+                 */
+                boolean refreshTokenRotated = tr.refreshToken != null && !tr.refreshToken.equals(refreshToken);
+                if (refreshTokenRotated) {
+                    updatedUserAccount.setLastTokenRotationTime(Instant.now().toString());
+                }
+
                 UserAccountManager.getInstance().updateAccount(account, updatedUserAccount);
                 updatedUserAccount.downloadProfilePhoto();
                 UserAccountManager.getInstance().clearCachedCurrentUser();
 
-                // Handle server-side Refresh Token Rotation: if the response contained a new refresh token,
-                // update this provider's cached copy.
-                if (tr.refreshToken != null && !tr.refreshToken.equals(refreshToken)) {
+                if (refreshTokenRotated) {
+                    /*
+                     * Update this provider's cached copy and surface RTR as a
+                     * per-user feature flag. The rotation timestamp is already
+                     * persisted (above), so RTR-Active state here is
+                     * independent of the timestamp's durability.
+                     */
                     refreshToken = tr.refreshToken;
-                    // Surface RTR as a per-user feature flag
                     SalesforceSDKManager.getInstance().registerUsedAppFeature(Features.FEATURE_RTR, updatedUserAccount);
                 }
 

libs/test/SalesforceSDKTest/src/com/salesforce/androidsdk/accounts/UserAccountManagerTest.java

@@ -246,6 +246,34 @@ public void test_givenDPoPAccount_whenUpdateAccount_thenCredentialsIdentifierAnd
                 newTokenType, restored.getTokenType());
     }
 
+    /*
+     * The RTR rotation timestamp must survive the full AccountManager
+     * persistence path (encrypt on updateAccount → decrypt on
+     * buildUserAccount), not just in-memory JSON/Bundle, so the "Last
+     * Rotation" value persists across an app restart. createTestAccount()
+     * leaves lastTokenRotationTime null, so this is the only test that
+     * exercises the new KEY_LAST_TOKEN_ROTATION_TIME encrypt/decrypt branch.
+     */
+    @Test
+    public void test_givenRotatedAccount_whenUpdateAccount_thenLastTokenRotationTimeRoundTrips() {
+        UserAccount original = UserAccountTest.createTestAccount();
+        Assert.assertNull("Precondition: rotation timestamp must start unset",
+                original.getLastTokenRotationTime());
+        userAccMgr.createAccount(original);
+        Account account = userAccMgr.getCurrentAccount();
+
+        final String rotationTime = "2026-07-30T12:34:56Z";
+        UserAccount rotated = UserAccountBuilder.getInstance()
+                .populateFromUserAccount(original)
+                .lastTokenRotationTime(rotationTime)
+                .build();
+        userAccMgr.updateAccount(account, rotated);
+
+        UserAccount restored = userAccMgr.buildUserAccount(account);
+        Assert.assertEquals("lastTokenRotationTime must survive updateAccount → buildUserAccount round-trip",
+                rotationTime, restored.getLastTokenRotationTime());
+    }
+
     /**
      * Test to get all authenticated users.
      */