Merge pull request #4121 from wmathurin/W-23721537-authflowtester-launch-arg-reset

feat(W-23721537): speed up AuthFlowTester UI tests via launch-arg driven SDK reset

Author: wmathurin

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Common/SFSDKAppFeatureMarkers.h

@@ -99,6 +99,14 @@ extern NSString * const kSFAppFeatureAppAttestation;
  */
 + (void)loadPersistedFeatures:(nonnull NSSet<NSString *> *)features forUser:(nonnull SFUserAccount *)user;
 
+#if DEBUG
+/**
+ Clears all per-user in-memory feature flags. Intended for UI test resets only.
+ NOT FOR PRODUCTION USE.
+ */
++ (void)resetPerUserFeaturesForUITesting;
+#endif
+
 @end
 
 NS_ASSUME_NONNULL_END

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Common/SFSDKAppFeatureMarkers.m

@@ -141,4 +141,12 @@ + (void)loadPersistedFeatures:(NSSet<NSString *> *)features forUser:(SFUserAccou
     });
 }
 
+#if DEBUG
++ (void)resetPerUserFeaturesForUITesting {
+    dispatch_sync(SFSDKAppFeatureDispatchQueue, ^{
+        [SFSDKPerUserFeatureMarkersMap removeAllObjects];
+    });
+}
+#endif
+
 @end

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Common/SalesforceSDKManager.h

@@ -391,6 +391,22 @@ NS_SWIFT_NAME(SalesforceManager)
  */
 - (id <SFNativeLoginManager>)nativeLoginManager;
 
+#if DEBUG
+/**
+ * Resets all local SDK auth state for UI testing.
+ *
+ * Logs out all users (including async server refresh-token revocation), resets the selected
+ * login host to login.salesforce.com, removes persisted custom login servers, and restores
+ * all SalesforceSDKManager auth flags to their post-init defaults.
+ *
+ * Call once at process startup when --resetSDKForUITesting is present in launch arguments,
+ * after initializeSDK and before the SDK's login flow begins.
+ *
+ * NOT FOR PRODUCTION USE.
+ */
++ (void)resetForUITesting NS_SWIFT_NAME(resetForUITesting());
+#endif
+
 @end
 
 NS_ASSUME_NONNULL_END

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/Common/SalesforceSDKManager.m

@@ -43,6 +43,7 @@
 #import "SFSDKSalesforceSDKUpgradeManager.h"
 #import <SalesforceSDKCommon/NSUserDefaults+SFAdditions.h>
 #import "SFSDKWindowManager+Internal.h"
+#import "SFSDKLoginHostStorage.h"
 
 // Error constants
 NSString * const kSalesforceSDKManagerErrorDomain     = @"com.salesforce.sdkmanager.error";
@@ -228,6 +229,42 @@ + (void)initializeSDKWithClass:(Class)className {
     [SalesforceSDKManager sharedManager];
 }
 
+- (void)resetAuthFlags {
+    self.useEphemeralSessionForAdvancedAuth = YES;
+    self.useWebServerAuthentication = YES;
+    self.useHybridAuthentication = YES;
+    self.useDPoP = NO;
+    self.sdk_forceAdvancedAuthentication = YES;
+    self.blockSalesforceIntegrationUser = NO;
+}
+
+#if DEBUG
++ (void)resetForUITesting {
+    // 1. Log out all users — clears on-disk account data, DPoP keychain keys, in-memory maps.
+    //    Refresh-token revocation fires asynchronously in the background.
+    [[SFUserAccountManager sharedInstance] logoutAllUsers];
+
+    // 2. Clear per-user in-memory feature flags (RT, DP, etc.) so flags from the previous test
+    //    do not bleed into the next one when the same user logs in again.
+    [SFSDKAppFeatureMarkers resetPerUserFeaturesForUITesting];
+
+    // 3. Reset selected login host to production default and persist it.
+    [SFUserAccountManager sharedInstance].loginHost = @"login.salesforce.com";
+
+    // 4. Remove custom login servers in-memory; save flushes the empty list to msdkUserDefaults
+    //    (SalesforceLoginHostListPrefs) so custom hosts do not reappear on next cold start.
+    //    Production (login.salesforce.com) and Sandbox (test.salesforce.com) are preserved.
+    SFSDKLoginHostStorage *storage = [SFSDKLoginHostStorage sharedInstance];
+    [storage removeAllLoginHosts];
+    [storage save];
+
+    // 5. Reset all auth flags to their -init defaults.
+    SalesforceSDKManager *mgr = [SalesforceSDKManager sharedManager];
+    [mgr resetAuthFlags];
+    mgr.simulatedDomainDiscoveryResult = nil;
+}
+#endif
+
 + (instancetype)sharedManager {
     static dispatch_once_t pred;
     static SalesforceSDKManager *sdkManager = nil;
@@ -328,12 +365,7 @@ - (instancetype)init {
         [self computeWebViewUserAgent]; // web view user agent is computed asynchronously so very first call to self.userAgentString(...) will be missing it
         self.userAgentString = [self defaultUserAgentString];
         self.URLCacheType = kSFURLCacheTypeEncrypted;
-        self.useEphemeralSessionForAdvancedAuth = YES;
-        self.useWebServerAuthentication = YES;
-        self.blockSalesforceIntegrationUser = NO;
-        self.useHybridAuthentication = YES;
-        self.useDPoP = NO;
-        self.sdk_forceAdvancedAuthentication = YES;
+        [self resetAuthFlags];
         [self setupServiceConfiguration];
         _snapshotViewControllers = [SFSDKSafeMutableDictionary new];
         _nativeLoginViewControllers = [SFSDKSafeMutableDictionary new];

libs/SalesforceSDKCore/SalesforceSDKCore/Classes/UserAccount/SFUserAccountManager.m

@@ -2182,6 +2182,9 @@ - (void)finalizeAuthCompletion:(SFSDKAuthSession *)authSession {
     SFOAuthType completedAuthType = authSession.oauthCoordinator.authInfo.authType;
     if (completedAuthType == SFOAuthTypeAdvancedBrowser) {
         [SFSDKAppFeatureMarkers registerAppFeature:kSFAppFeatureSafariBrowserForLogin forUser:userAccount];
+    } else if (completedAuthType == SFOAuthTypeRefreshTokenMigration) {
+        // Migration exchanges the token but does not change how the user originally
+        // authenticated. Preserve the existing per-user BW flag rather than clearing it.
     } else {
         [SFSDKAppFeatureMarkers unregisterAppFeature:kSFAppFeatureSafariBrowserForLogin forUser:userAccount];
     }

native/SampleApps/AuthFlowTester/AuthFlowTester/Classes/AppDelegate.swift

@@ -40,6 +40,11 @@ class AppDelegate: UIResponder, UIApplicationDelegate {
         super.init()
 
         SalesforceManager.initializeSDK()
+        #if DEBUG
+        if CommandLine.arguments.contains("--resetSDKForUITesting") {
+            SalesforceManager.resetForUITesting()
+        }
+        #endif
         SalesforceManager.shared.appDisplayName = "Auth Flow Tester"
         UserAccountManager.shared.navigationPolicyForAction = { webView, action in
             if let url = action.request.url, url.absoluteString == "https://www.salesforce.com/us/company/privacy" {

native/SampleApps/AuthFlowTester/AuthFlowTester/Views/UserCredentialsView.swift

@@ -282,7 +282,7 @@ struct UserCredentialsView: View {
         result[CredentialsLabels.tokens] = [
             CredentialsLabels.accessToken: accessToken,
             CredentialsLabels.refreshToken: refreshToken,
-            CredentialsLabels.tokenFormat: tokenFormat,
+            CredentialsLabels.tokenFormat: tokenFormatRaw,
             CredentialsLabels.jwt: jwt,
             CredentialsLabels.authCode: authCode,
             CredentialsLabels.challengeString: challengeString,
@@ -401,9 +401,12 @@ struct UserCredentialsView: View {
         return credentials?.refreshToken ?? ""
     }
 
+    private var tokenFormatRaw: String {
+        return credentials?.tokenFormat ?? ""
+    }
+
     private var tokenFormat: String {
-        let value = credentials?.tokenFormat ?? ""
-        return value.isEmpty ? "Opaque" : value
+        return tokenFormatRaw.isEmpty ? "Opaque" : tokenFormatRaw
     }
 
     private var jwt: String {

native/SampleApps/AuthFlowTester/AuthFlowTesterUITests/PageObjects/LoginPageObject.swift

@@ -208,6 +208,16 @@ class LoginPageObject {
         return app.webViews.webViews.webViews.textFields.firstMatch.waitForExistence(timeout: timeout)
     }
 
+    /// True when the in-app login view controller (`SFLoginViewController`) is showing, detected
+    /// by its "Log In" navigation bar title. This appears as soon as the view controller is
+    /// presented — before the WKWebView has loaded the login page — so it is faster and more
+    /// reliable than `isShowingInAppLoginForm()` for asserting that the SDK chose the in-app
+    /// WebView modality rather than the external browser. Pass `UITestTimeouts.short` for the
+    /// negative assertion (not showing).
+    func isShowingLoginViewController(timeout: TimeInterval = UITestTimeouts.long) -> Bool {
+        return loginNavigationBar().waitForExistence(timeout: timeout)
+    }
+
     /// True when the Settings gear is present on the current login nav bar. Under forced advanced
     /// auth the gear lives on the host list; on the legacy path it lives on the in-app WebView
     /// ("Log In"). Both expose the same accessibility identifier "settings".
@@ -434,7 +444,7 @@ class LoginPageObject {
 
     private func hasHost(host: String) -> Bool {
         let row = hostRow(host: host)
-        return row.waitForExistence(timeout: UITestTimeouts.long)
+        return row.waitForExistence(timeout: UITestTimeouts.short)
     }
 }
 

native/SampleApps/AuthFlowTester/AuthFlowTesterUITests/Tests/DPoPLoginTests.swift

@@ -112,7 +112,6 @@ class DPoPLoginTests: BaseAuthFlowTester {
             staticScopeSelection: .subset,
             migrationAppConfigName: .ecaJwtDpop,
             migrationScopeSelection: .all,
-            forceAdvancedAuthentication: false,
             useDPoP: true
         )
 
@@ -131,7 +130,6 @@ class DPoPLoginTests: BaseAuthFlowTester {
             staticAppConfigName: .ecaJwtDpop,
             migrationAppConfigName: .ecaJwtDpopRtr,
             migrationUseHybridFlow: false,
-            forceAdvancedAuthentication: false,
             useDPoP: true
         )
 

native/SampleApps/AuthFlowTester/AuthFlowTesterUITests/Tests/ForceAdvancedAuthTests.swift

@@ -88,9 +88,6 @@ class ForceAdvancedAuthTests: BaseAuthFlowTester {
                       "Forced advanced auth on the standard server should launch the external browser")
         XCTAssertFalse(isShowingInAppLoginForm(timeout: UITestTimeouts.short),
                        "The in-app WebView login form must NOT be shown when advanced auth is forced on")
-
-        // Never completed login — remain on the browser surface; the next launch() self-heals.
-        skipLogoutAtTearDown()
     }
 
     /// Flag OFF (imported explicitly), standard server.
@@ -102,20 +99,21 @@ class ForceAdvancedAuthTests: BaseAuthFlowTester {
         launch()
 
         // Reach the host list (fresh launch shows the browser), pin the standard server, then
-        // import forceAdvancedAuthentication = false via the gear → Login Options JSON hook. A valid
-        // app config is imported alongside it so the WebView can load a real login page. Closing
-        // Login Options restarts authentication, now in the legacy WebView.
+        // import forceAdvancedAuthentication = false via the gear → Login Options JSON hook. No
+        // app config override — the bootconfig.plist consumer key is an org-specific test CA that
+        // may not resolve on login.salesforce.com, so we don't wait for the login page to finish
+        // loading. Instead we assert that the SDK chose the in-app WebView modality (the "Log In"
+        // nav bar appears as soon as SFLoginViewController is presented, before the WKWebView
+        // completes the page load). Closing Login Options restarts authentication, now in WebView.
         returnToLoginHostList(expectingBrowser: true)
         configureLoginHost(productionHostDisplayName)
         returnToLoginHostList(expectingBrowser: true)
-        setForceAdvancedAuthentication(false, staticAppConfigName: .ecaOpaque)
+        setForceAdvancedAuthentication(false)
 
-        XCTAssertTrue(isShowingInAppLoginForm(),
-                      "With advanced auth disabled, the standard server should use the in-app WebView login form")
+        XCTAssertTrue(isShowingLoginViewController(),
+                      "With advanced auth disabled, the standard server should present the in-app login view controller")
         XCTAssertFalse(isShowingBrowserLogin(timeout: UITestTimeouts.short),
                        "The external browser must NOT be shown when advanced auth is disabled")
-
-        skipLogoutAtTearDown()
     }
 
     /// Flag ON (default), `regular_auth` My Domain that does NOT opt into browser login.
@@ -125,12 +123,13 @@ class ForceAdvancedAuthTests: BaseAuthFlowTester {
     /// `launchLoginAndValidate`). Advanced auth always pairs with the web server flow, so this is a
     /// web-server-flow login.
     func testForceAdvancedAuth_MyDomainRegularHost_RemainsBrowser() throws {
-        // Default flag (nil) inherits the production default (advanced auth ON), so login runs in the
-        // external browser; validation asserts credentials and a REST round-trip.
+        // Pass `true` to explicitly force advanced auth ON so login runs in the external browser;
+        // validation asserts credentials and a REST round-trip.
         launchLoginAndValidate(
             loginHost: .regularAuth,
             user: .first,
-            staticAppConfigName: .ecaOpaque
+            staticAppConfigName: .ecaOpaque,
+            forceAdvancedAuthentication: true
         )
     }
 
@@ -144,11 +143,12 @@ class ForceAdvancedAuthTests: BaseAuthFlowTester {
     /// Pre-fix regression this guards: the forced path created the picker with `hidesCancelButton =
     /// YES` and no back control, stranding the add-user flow.
     func testForceAdvancedAuth_AddAdditionalUser_BackButtonAccessible() throws {
-        // Log in the first user under the default flag (external browser).
+        // Log in the first user with advanced auth explicitly ON (external browser).
         launchAndLogin(
             loginHost: .regularAuth,
             user: .first,
-            staticAppConfigName: .ecaOpaque
+            staticAppConfigName: .ecaOpaque,
+            forceAdvancedAuthentication: true
         )
 
         // Trigger Add New Account (Switch User → New User): under forced advanced auth this launches
@@ -187,8 +187,6 @@ class ForceAdvancedAuthTests: BaseAuthFlowTester {
         openLoginOptions()
         XCTAssertTrue(isShowingAuthFlowTypesView(),
                       "The picker's Login Options entry should open the Auth Flow Types dev screen")
-
-        skipLogoutAtTearDown()
     }
 
     /// §5a/§5b parity — Flag OFF. With one user already logged in, adding another account on the
@@ -214,7 +212,5 @@ class ForceAdvancedAuthTests: BaseAuthFlowTester {
                       "On the legacy WebView path, adding a user should show the same accessible back control")
         XCTAssertTrue(isShowingLoginSettingsGear(),
                       "On the legacy WebView path, adding a user should show the same dev-menu gear")
-
-        skipLogoutAtTearDown()
     }
 }