Fix nil-sceneId crash on advanced-auth browser callback for pre-scene logins - #4098
Merged
brandonpage merged 2 commits intoJul 9, 2026
Merged
Conversation
… logins Apps that trigger login before any UIScene connects (hybrid and React Native start login from AppDelegate.didFinishLaunchingWithOptions) had a nil sceneId, which crashed the advanced-auth browser callback when building the kSFIDPSceneIdKey options dictionary and dropped the session from the authSessions store. Synthesize a unique per-session scene id when no scene is connected so each session gets its own authSessions[] key, and add a nil guard when building the callback options. Adds unit tests for the scene-less case.
Clang Static Analysis Issues
Generated by 🚫 Danger |
|
||||||||||||||
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## dev #4098 +/- ##
==========================================
+ Coverage 67.24% 67.33% +0.09%
==========================================
Files 247 247
Lines 21835 21837 +2
==========================================
+ Hits 14683 14705 +22
+ Misses 7152 7132 -20
🚀 New features to boost your workflow:
|
The nil-guard lines lived inside the ASWebAuthenticationSession completion block, which only runs on a live browser callback, so they were unreachable by unit tests and showed as uncovered in the PR patch coverage. Extract the option-building into -browserCallbackOptionsForSceneId: (declared in SFOAuthCoordinator+Internal.h) and add tests for both branches: a non-nil sceneId is carried under kSFIDPSceneIdKey, and a nil sceneId yields an empty dictionary instead of crashing on a nil insert. Behavior is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||||||||||||||||||
wmathurin
approved these changes
Jul 9, 2026
JohnsonEricAtSalesforce
added a commit
to JohnsonEricAtSalesforce/SalesforceMobileSDK-iOS
that referenced
this pull request
Jul 20, 2026
… callback (unit 43/49) Semantic re-implementation FROM forcedotcom/dev e4e8388 INTO the ObjC->Swift migration branch. OAuth advanced-auth (ASWebAuthenticationSession) scene fix. When advanced-auth login starts before any UIScene has connected (cold launch), or the weak authSession deallocates before the browser callback fires, sceneId was nil and got inserted into the URL-handler options dictionary, crashing on the nil insert and dropping the session from the authSessions store. Ported into the compiled Swift twins: - SFSDKAuthSession.swift: synthesize a unique per-session scene id (com.salesforce.mobilesdk.unscopedAuthSession-<UUID>) when no scene is connected. This also fixes a latent collision in the migration, where the non-optional sceneId defaulted to "" and all scene-less sessions shared one authSessions[] key. - SFOAuthCoordinator.swift: browserCallbackOptions(forSceneId:) omits the key when the id is nil (empty dict) instead of inserting nil; the URL handler then falls back to the default scene. Helper is internal (visible to @testable), no new public API. De-referenced .m files (SFSDKAuthSession.m, SFOAuthCoordinator.m, SFOAuthCoordinatorTests.m) ref-synced byte-faithful to upstream for clean future merges; SFOAuthCoordinator+Internal.h is a migration tombstone (skip). The 4 new tests were also ported to the compiled Swift twin SFOAuthCoordinatorTests.swift. SDKCore/SmartStore/MobileSync TEST BUILD SUCCEEDED (0 errors, 0 new warnings); 6 SFOAuthCoordinatorTests pass. Marker advanced 42->43 (e4e8388). Escalation: OAuth advanced-auth/scene callback behavior -- flag in PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Fixes a crash on the advanced-authentication browser callback for logins that start before any
UIScenehas connected — i.e. apps that begin login fromAppDelegate.didFinishLaunchingWithOptions(hybrid and React Native).Root cause
When login starts pre-scene,
request.scene.session.persistentIdentifierisnil, soSFSDKAuthSession.sceneIdwasnil. On theASWebAuthenticationSessioncompletion handler, the SDK built an options dictionary keyed by the scene id (kSFIDPSceneIdKey) and looked the session back up in theauthSessionsstore by that id. Anilkey both crashed the dictionary insert and dropped the session from the store.Fix
SFSDKAuthSession.m— synthesize a unique per-session scene id (com.salesforce.mobilesdk.unscopedAuthSession-<UUID>) when no scene is connected, so each scene-less session gets its ownauthSessions[]key and the browser callback can key back to it.SFOAuthCoordinator.m— add anilguard when building the callback options dictionary.SFOAuthCoordinatorTests.m— unit tests covering the scene-less login case.Testing
forceAdvancedAuthenticationenabled: browser login → token exchange → account + photo fetch all succeed with no crash (previously crashed on the browser callback).